## References for product fedora

- anssi

- BP28(R08)

- security_patches_up_to_dateEnsure Software Patches Installed

- BP28(R1)

- package_sendmail_removedUninstall Sendmail Package
- package_telnetd_removedUninstall the telnet server

- BP28(R10)

- prefer_64bit_osPrefer to use a 64-bit Operating System when supported

- BP28(R11)

- grub2_enable_iommu_forceIOMMU configuration directive

- BP28(R12)

- mount_option_boot_noautoAdd noauto Option to /boot
- mount_option_boot_noexecAdd noexec Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_home_noexecAdd noexec Option to /home
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_opt_nosuidAdd nosuid Option to /opt
- mount_option_proc_hidepidAdd hidepid Option to /proc
- mount_option_srv_nosuidAdd nosuid Option to /srv
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_noexecAdd noexec Option to /var
- mount_option_var_nosuidAdd nosuid Option to /var
- partition_for_bootEnsure /boot Located On Separate Partition
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_optEnsure /opt Located On Separate Partition
- partition_for_srvEnsure /srv Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_usrEnsure /usr Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition

- BP28(R13)

- file_permissions_systemmapVerify that local System.map file (if exists) is readable only by root

- BP28(R15)

- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories

- BP28(R17)

- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password

- BP28(R18)

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts

- BP28(R19)

- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- no_direct_root_loginsDirect root Logins Not Allowed
- package_sudo_installedInstall sudo Package
- sshd_disable_root_loginDisable SSH Root Login

- BP28(R22)

- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_ip_local_port_rangeSet Kernel Parameter to Increase Local Port Range
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_accept_ra_defrtrConfigure Accepting Default Router in Router Advertisements on All IPv6 Interfaces
- sysctl_net_ipv6_conf_all_accept_ra_pinfoConfigure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces
- sysctl_net_ipv6_conf_all_accept_ra_rtr_prefConfigure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces
- sysctl_net_ipv6_conf_all_autoconfConfigure Auto Configuration on All IPv6 Interfaces
- sysctl_net_ipv6_conf_all_max_addressesConfigure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces
- sysctl_net_ipv6_conf_all_router_solicitationsConfigure Denying Router Solicitations on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_ra_defrtrConfigure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default
- sysctl_net_ipv6_conf_default_accept_ra_pinfoConfigure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default
- sysctl_net_ipv6_conf_default_accept_ra_rtr_prefConfigure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_autoconfConfigure Auto Configuration on All IPv6 Interfaces By Default
- sysctl_net_ipv6_conf_default_max_addressesConfigure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default
- sysctl_net_ipv6_conf_default_router_solicitationsConfigure Denying Router Solicitations on All IPv6 Interfaces By Default

- BP28(R23)

- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_perf_cpu_time_max_percentLimit CPU consumption of the Perf system
- sysctl_kernel_perf_event_max_sample_rateLimit sampling frequency of the Perf system
- sysctl_kernel_perf_event_paranoidDisallow kernel profiling by unprivileged users
- sysctl_kernel_pid_maxConfigure maximum number of process identifiers
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
- sysctl_kernel_sysrqDisallow magic SysRq key
- sysctl_vm_mmap_min_addrPrevent applications from mapping low portion of virtual memory

- BP28(R24)

- sysctl_kernel_modules_disabledDisable loading and unloading of kernel modules

- BP28(R25)

- sysctl_kernel_yama_ptrace_scopeRestrict usage of ptrace to descendant processes

- BP28(R29)

- accounts_tmoutSet Interactive Session Timeout
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max

- BP28(R32)

- accounts_password_pam_unix_rounds_password_authSet number of Password Hashing Rounds - password-auth
- accounts_password_pam_unix_rounds_system_authSet number of Password Hashing Rounds - system-auth
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm

- BP28(R35)

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile

- BP28(R36)

- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions

- BP28(R37)

- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized

- BP28(R38)

- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized

- BP28(R39)

- accounts_polyinstantiated_tmpConfigure Polyinstantiation of /tmp Directories
- accounts_polyinstantiated_var_tmpConfigure Polyinstantiation of /var/tmp Directories
- enable_pam_namespaceSet Up a Private Namespace in PAM Configuration

- BP28(R4)

- selinux_stateEnsure SELinux State is Enforcing

- BP28(R40)

- dir_perms_world_writable_root_ownedEnsure All World-Writable Directories Are Owned by root user
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist

- BP28(R43)

- chronyd_specify_remote_serverA remote time server for Chrony is configured
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- package_chrony_installedThe Chrony package is installed
- package_rsyslog-gnutls_installedEnsure rsyslog-gnutls is installed
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_tlsConfigure TLS for rsyslog remote logging
- rsyslog_remote_tls_cacertConfigure CA certificate for rsyslog remote logging

- BP28(R46)

- package_syslogng_installedEnsure syslog-ng is Installed
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- service_syslogng_enabledEnable syslog-ng Service

- BP28(R47)

- partition_for_var_logEnsure /var/log Located On Separate Partition

- BP28(R49)

- postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account

- BP28(R5)

- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- BP28(R50)

- package_audit_installedEnsure the audit Subsystem is Installed
- package_cron_installedInstall the cron service

- BP28(R51)

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- package_aide_installedInstall AIDE

- BP28(R58)

- sudo_add_noexecEnsure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC
- sudo_add_requirettyEnsure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty
- sudo_add_use_ptyEnsure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty

- BP28(R59)

- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- BP28(R60)

- sudoers_no_root_targetDon't target root user in the sudoers file

- BP28(R61)

- sudoers_no_command_negationDon't define allowed commands in sudoers by means of exclusion

- BP28(R63)

- sudoers_explicit_command_argsExplicit arguments in sudo specifications

- BP28(R66)

- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing

- BP28(R68)

- package_setroubleshoot-plugins_removedUninstall setroubleshoot-plugins Package
- package_setroubleshoot-server_removedUninstall setroubleshoot-server Package
- package_setroubleshoot_removedUninstall setroubleshoot Package

- BP28(R7)

- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- BP28(R8)

- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically
- dnf-automatic_security_updates_onlyConfigure dnf-automatic to Install Only Security Updates
- package_dnf-automatic_installedInstall dnf-automatic Package
- timer_dnf-automatic_enabledEnable dnf-automatic Timer

- BP28(R9)

- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl

- NT007(R02)

- package_telnetd-ssl_removedUninstall the ssl compliant telnet server

- NT007(R03)

- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd_removedUninstall the telnet server

- NT007(R1)

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- NT007(R17)

- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords

- NT007(R21)

- sshd_disable_root_loginDisable SSH Root Login

- NT012(R03)

- package_ntp_installedInstall the ntp service
- service_ntp_enabledEnable the NTP Daemon

- NT12(R18)

- ensure_logrotate_activatedEnsure Logrotate Runs Periodically

- NT12(R5)

- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- NT28(R43)

- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- NT28(R46)

- package_rsyslog_installedEnsure rsyslog is Installed
- service_rsyslog_enabledEnable rsyslog Service

- cis-csc

- 1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- banner_etc_issueModify the System Login Banner
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_users_coredumpsDisable Core Dumps for All Users
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- install_hidsInstall Intrusion Detection Software
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_screen_installedInstall the screen Package
- package_syslogng_installedEnsure syslog-ng is Installed
- package_tmux_installedInstall the tmux Package
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- 11

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 12

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- banner_etc_issueModify the System Login Banner
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- disable_users_coredumpsDisable Core Dumps for All Users
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_antivirusInstall Virus Scanning Software
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_screen_installedInstall the screen Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- 13

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_users_coredumpsDisable Core Dumps for All Users
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_antivirusInstall Virus Scanning Software
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_openssh-server_installedInstall the OpenSSH Server Package
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- 14

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- avahi_disable_publishingDisable Avahi Publishing
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_anacronDisable anacron Service
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_antivirusInstall Virus Scanning Software
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_ntp_installedInstall the ntp service
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_rsyslog_installedEnsure rsyslog is Installed
- package_sendmail_removedUninstall Sendmail Package
- package_syslogng_installedEnsure syslog-ng is Installed
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- umask_for_daemonsSet Daemon Umask
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 15

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- banner_etc_issueModify the System Login Banner
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- disable_users_coredumpsDisable Core Dumps for All Users
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_screen_installedInstall the screen Package
- package_syslogng_installedEnsure syslog-ng is Installed
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- 16

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- banner_etc_issueModify the System Login Banner
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- disable_users_coredumpsDisable Core Dumps for All Users
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_hidsInstall Intrusion Detection Software
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_screen_installedInstall the screen Package
- package_syslogng_installedEnsure syslog-ng is Installed
- package_tmux_installedInstall the tmux Package
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- 18

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_hidsInstall Intrusion Detection Software
- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- root_path_defaultRoot Path Must Be Vendor Default
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- security_patches_up_to_dateEnsure Software Patches Installed
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- 19

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- 2

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- disable_users_coredumpsDisable Core Dumps for All Users
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_hashesVerify File Hashes with RPM
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- 20

- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- security_patches_up_to_dateEnsure Software Patches Installed
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- 3

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_anacronDisable anacron Service
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_sendmail_removedUninstall Sendmail Package
- package_syslogng_installedEnsure syslog-ng is Installed
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- umask_for_daemonsSet Daemon Umask
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_antivirusInstall Virus Scanning Software
- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- security_patches_up_to_dateEnsure Software Patches Installed
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- 5

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_libreswan_installedInstall libreswan Package
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_nfs_disabledDisable Network File System (nfs)
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- umask_for_daemonsSet Daemon Umask

- 6

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- 7

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_users_coredumpsDisable Core Dumps for All Users
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- install_antivirusInstall Virus Scanning Software
- install_hidsInstall Intrusion Detection Software
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- 8

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_users_coredumpsDisable Core Dumps for All Users
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_antivirusInstall Virus Scanning Software
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- 9

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- cjis

- 5.10.1

- kernel_module_dccp_disabledDisable DCCP Support
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets

- 5.10.1.1

- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- 5.10.1.3

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- package_aide_installedInstall AIDE

- 5.10.4.1

- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- security_patches_up_to_dateEnsure Software Patches Installed

- 5.13.1.3

- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module

- 5.4.1.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- service_auditd_enabledEnable auditd Service

- 5.5.2

- account_unique_nameEnsure All Accounts on the System Have Unique Names
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_empty_passwordsPrevent Login to Accounts With Empty Password

- 5.5.2.2

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File

- 5.5.3

- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts

- 5.5.5

- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver

- 5.5.6

- disable_host_authDisable Host-Based Authentication
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- 5.6.2.1

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs

- 5.6.2.1.1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_unix_rememberLimit Password Reuse

- 5.6.2.2

- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm

- cobit5

- APO01.06

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_antivirusInstall Virus Scanning Software
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- APO07.06

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- APO08.04

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- APO10.01

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- APO10.03

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- APO10.04

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- APO10.05

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- APO11.04

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- APO11.06

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- APO12.01

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- APO12.02

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- APO12.03

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- APO12.04

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- APO12.06

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- APO13.01

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- disable_users_coredumpsDisable Core Dumps for All Users
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- root_path_defaultRoot Path Must Be Vendor Default
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- APO13.02

- install_antivirusInstall Virus Scanning Software
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- BAI01.06

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- package_aide_installedInstall AIDE
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux

- BAI02.01

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- install_antivirusInstall Virus Scanning Software
- package_aide_installedInstall AIDE

- BAI03.01

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- root_path_defaultRoot Path Must Be Vendor Default
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- BAI03.02

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- root_path_defaultRoot Path Must Be Vendor Default
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- BAI03.03

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- root_path_defaultRoot Path Must Be Vendor Default
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- BAI03.05

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_aide_installedInstall AIDE
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- BAI03.08

- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- BAI03.10

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- security_patches_up_to_dateEnsure Software Patches Installed

- BAI04.04

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- disable_users_coredumpsDisable Core Dumps for All Users
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- BAI06.01

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- install_antivirusInstall Virus Scanning Software
- package_aide_installedInstall AIDE
- rpm_verify_hashesVerify File Hashes with RPM
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux

- BAI07.04

- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- BAI08.02

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- BAI08.04

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- BAI09.01

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer

- BAI09.02

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer

- BAI09.03

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer

- BAI10.01

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- BAI10.02

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- BAI10.03

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- BAI10.05

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- DSS01.03

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- disable_users_coredumpsDisable Core Dumps for All Users
- install_hidsInstall Intrusion Detection Software
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- DSS01.04

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_rsh_trust_filesRemove Rsh Trust Files
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- DSS01.05

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- DSS02.02

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- service_auditd_enabledEnable auditd Service

- DSS02.04

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- DSS02.05

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DSS02.07

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- DSS03.01

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- DSS03.04

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DSS03.05

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- disable_users_coredumpsDisable Core Dumps for All Users
- install_hidsInstall Intrusion Detection Software
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- DSS04.05

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DSS04.07

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- install_antivirusInstall Virus Scanning Software
- package_aide_installedInstall AIDE

- DSS05.01

- install_antivirusInstall Virus Scanning Software
- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- DSS05.02

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_antivirusInstall Virus Scanning Software
- install_hidsInstall Intrusion Detection Software
- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- security_patches_up_to_dateEnsure Software Patches Installed
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- DSS05.03

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- install_antivirusInstall Virus Scanning Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- DSS05.04

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- banner_etc_issueModify the System Login Banner
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_hidsInstall Intrusion Detection Software
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_libreswan_installedInstall libreswan Package
- package_ntp_installedInstall the ntp service
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_rsyslog_installedEnsure rsyslog is Installed
- package_screen_installedInstall the screen Package
- package_syslogng_installedEnsure syslog-ng is Installed
- package_tmux_installedInstall the tmux Package
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- DSS05.05

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- avahi_disable_publishingDisable Avahi Publishing
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- DSS05.06

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp

- DSS05.07

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- disable_users_coredumpsDisable Core Dumps for All Users
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_hidsInstall Intrusion Detection Software
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_ntp_installedInstall the ntp service
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- DSS05.10

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_passwordSet Boot Loader Password in grub2
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- package_screen_installedInstall the screen Package
- package_tmux_installedInstall the tmux Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- service_autofs_disabledDisable the Automounter
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- DSS06.01

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DSS06.02

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- DSS06.03

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_autofs_disabledDisable the Automounter
- service_nfs_disabledDisable Network File System (nfs)
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- DSS06.06

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_antivirusInstall Virus Scanning Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- DSS06.10

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_passwordSet Boot Loader Password in grub2
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- package_screen_installedInstall the screen Package
- package_tmux_installedInstall the tmux Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- service_autofs_disabledDisable the Automounter
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- MEA01.01

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- MEA01.02

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- MEA01.03

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- MEA01.04

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- MEA01.05

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- MEA02.01

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- MEA03.03

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- MEA03.04

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- cui

- 3.1.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login

- 3.1.10

- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- package_screen_installedInstall the screen Package
- package_tmux_installedInstall the tmux Package

- 3.1.11

- accounts_tmoutSet Interactive Session Timeout
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- 3.1.12

- dconf_gnome_remote_access_credential_promptRequire Credential Prompting for Remote Access in GNOME3
- disable_host_authDisable Host-Based Authentication
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_use_priv_separationEnable Use of Privilege Separation

- 3.1.13

- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- 3.1.16

- dconf_gnome_disable_wifi_createDisable WIFI Network Connection Creation in GNOME3
- dconf_gnome_disable_wifi_notificationDisable WIFI Network Notification in GNOME3
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- network_nmcli_permissionsPrevent non-Privileged Users from Modifying Network Interfaces using nmcli
- service_bluetooth_disabledDisable Bluetooth Service
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 3.1.2

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing

- 3.1.20

- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_ipv6_privacy_extensionsUse Privacy Extensions for Address
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 3.1.21

- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver

- 3.1.3

- service_firewalld_enabledVerify firewalld Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets

- 3.1.5

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- dconf_gnome_disable_user_adminDisable User Administration in GNOME3
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer

- 3.1.6

- no_direct_root_loginsDirect root Logins Not Allowed

- 3.1.7

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 3.1.8

- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- dconf_gnome_login_retriesSet the GNOME3 Login Number of Failures

- 3.1.9

- banner_etc_issueModify the System Login Banner
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- 3.13.10

- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files

- 3.13.11

- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm

- 3.13.6

- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets

- 3.3.1

- audit_rules_immutableMake the auditd Configuration Immutable
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- service_auditd_enabledEnable auditd Service

- 3.3.2

- service_auditd_enabledEnable auditd Service

- 3.3.6

- service_auditd_enabledEnable auditd Service

- 3.3.7

- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon

- 3.3.8

- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- 3.4.1

- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- 3.4.3

- audit_rules_immutableMake the auditd Configuration Immutable

- 3.4.5

- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- service_debug-shell_disabledDisable debug-shell SystemD Service

- 3.4.6

- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- service_autofs_disabledDisable the Automounter

- 3.4.7

- service_firewalld_enabledVerify firewalld Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets

- 3.4.8

- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories

- 3.5.10

- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed

- 3.5.4

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- 3.5.6

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age

- 3.5.7

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs

- 3.5.8

- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age

- 3.7.2

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing

- disa

- CCI-000015

- accounts_password_pam_enforce_localEnsure PAM Enforces Password Requirements - Enforce for Local Accounts Only
- accounts_passwords_pam_faillock_enforce_localEnforce pam_faillock for Local Accounts Only

- CCI-000016

- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts

- CCI-000017

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity

- CCI-000018

- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- CCI-000022

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux

- CCI-000032

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux

- CCI-000044

- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts

- CCI-000048

- banner_etc_issueModify the System Login Banner
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- ftp_present_bannerCreate Warning Banners for All FTP Users
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-000050

- banner_etc_issueModify the System Login Banner
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-000054

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User

- CCI-000056

- configure_bashrc_exec_tmuxSupport session locking with tmux
- configure_tmux_lock_commandConfigure the tmux Lock Command
- dconf_gnome_lock_screen_on_smartcard_removalEnable the GNOME3 Screen Locking On Smartcard Removal
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- no_tmux_in_shellsPrevent user from disabling the screen lock
- package_tmux_installedInstall the tmux Package

- CCI-000057

- accounts_tmoutSet Interactive Session Timeout
- configure_tmux_lock_after_timeConfigure tmux to lock session after inactivity
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- package_screen_installedInstall the screen Package

- CCI-000058

- configure_tmux_lock_commandConfigure the tmux Lock Command
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- package_screen_installedInstall the screen Package
- package_tmux_installedInstall the tmux Package

- CCI-000060

- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver

- CCI-000067

- rsyslog_remote_access_monitoringEnsure remote access methods are monitored in Rsyslog
- sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE

- CCI-000068

- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- sshd_rekey_limitForce frequent session key renegotiation
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- CCI-000085

- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- service_bluetooth_disabledDisable Bluetooth Service
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- CCI-000087

- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions

- CCI-000126

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- service_auditd_enabledEnable auditd Service
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default

- CCI-000130

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- service_auditd_enabledEnable auditd Service

- CCI-000131

- service_auditd_enabledEnable auditd Service

- CCI-000132

- service_auditd_enabledEnable auditd Service

- CCI-000133

- service_auditd_enabledEnable auditd Service

- CCI-000134

- service_auditd_enabledEnable auditd Service

- CCI-000135

- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- service_auditd_enabledEnable auditd Service

- CCI-000136

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- CCI-000139

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account

- CCI-000140

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size

- CCI-000154

- service_auditd_enabledEnable auditd Service

- CCI-000158

- service_auditd_enabledEnable auditd Service

- CCI-000160

- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- chronyd_specify_remote_serverA remote time server for Chrony is configured
- package_ntp_installedInstall the ntp service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon

- CCI-000162

- audit_rules_immutableMake the auditd Configuration Immutable
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive

- CCI-000163

- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive

- CCI-000164

- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive

- CCI-000169

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- configure_usbguard_auditbackendLog USBGuard daemon audit events using Linux Audit
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_audit_installedEnsure the audit Subsystem is Installed
- service_auditd_enabledEnable auditd Service

- CCI-000171

- file_groupownership_audit_configurationAudit Configuration Files Must Be Owned By Group root
- file_ownership_audit_configurationAudit Configuration Files Must Be Owned By Root
- file_permissions_etc_audit_auditdVerify Permissions on /etc/audit/auditd.conf
- file_permissions_etc_audit_rulesdVerify Permissions on /etc/audit/rules.d/*.rules

- CCI-000172

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_execution_seunshareRecord Any Attempts to Run seunshare
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_privileged_commands_atEnsure auditd Collects Information on the Use of Privileged Commands - at
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_chmodRecord Unsuccessul Permission Changes to Files - chmod
- audit_rules_unsuccessful_file_modification_chownRecord Unsuccessul Ownership Changes to Files - chown
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_fchmodRecord Unsuccessul Permission Changes to Files - fchmod
- audit_rules_unsuccessful_file_modification_fchmodatRecord Unsuccessul Permission Changes to Files - fchmodat
- audit_rules_unsuccessful_file_modification_fchownRecord Unsuccessul Ownership Changes to Files - fchown
- audit_rules_unsuccessful_file_modification_fchownatRecord Unsuccessul Ownership Changes to Files - fchownat
- audit_rules_unsuccessful_file_modification_fremovexattrRecord Unsuccessul Permission Changes to Files - fremovexattr
- audit_rules_unsuccessful_file_modification_fsetxattrRecord Unsuccessul Permission Changes to Files - fsetxattr
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_lchownRecord Unsuccessul Ownership Changes to Files - lchown
- audit_rules_unsuccessful_file_modification_lremovexattrRecord Unsuccessul Permission Changes to Files - lremovexattr
- audit_rules_unsuccessful_file_modification_lsetxattrRecord Unsuccessul Permission Changes to Files - lsetxattr
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_removexattrRecord Unsuccessul Permission Changes to Files - removexattr
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_setxattrRecord Unsuccessul Permission Changes to Files - setxattr
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-000187

- sssd_enable_certmapEnable Certmap in SSSD

- CCI-000192

- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters

- CCI-000193

- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters

- CCI-000194

- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User

- CCI-000195

- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories

- CCI-000196

- accounts_password_all_shadowed_sha512Verify All Account Password Hashes are Shadowed with SHA512
- accounts_password_pam_unix_rounds_password_authSet number of Password Hashing Rounds - password-auth
- accounts_password_pam_unix_rounds_system_authSet number of Password Hashing Rounds - system-auth
- no_netrc_filesVerify No netrc Files Exist
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm

- CCI-000197

- package_vsftpd_removedUninstall vsftpd Package
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- CCI-000198

- accounts_minimum_age_login_defsSet Password Minimum Age

- CCI-000199

- accounts_maximum_age_login_defsSet Password Maximum Age

- CCI-000200

- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_unix_rememberLimit Password Reuse

- CCI-000205

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length

- CCI-000213

- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode

- CCI-000225

- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable

- CCI-000318

- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- CCI-000336

- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections

- CCI-000366

- accounts_authorized_local_usersOnly Authorized Local User Accounts Exist on Operating System
- accounts_have_homedir_login_defsEnsure Home Directories are Created for New Users
- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_pam_dictcheckEnsure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_pwquality_password_authEnsure PAM password complexity module is enabled in password-auth
- accounts_password_pam_pwquality_system_authEnsure PAM password complexity module is enabled in system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- auditd_local_eventsInclude Local Events in Audit Logs
- auditd_log_formatResolve information before writing to audit logs
- coredump_disable_backtracesDisable core dump backtraces
- coredump_disable_storageDisable storing core dump
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dir_perms_world_writable_root_ownedEnsure All World-Writable Directories Are Owned by root user
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- disable_users_coredumpsDisable Core Dumps for All Users
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- install_antivirusInstall Virus Scanning Software
- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_home_noexecAdd noexec Option to /home
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- network_ipv6_default_gatewayManually Assign IPv6 Router Address
- network_ipv6_privacy_extensionsUse Privacy Extensions for Address
- network_ipv6_static_addressManually Assign Global IPv6 Address
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_empty_passwords_etc_shadowEnsure There Are No Accounts With Blank or Null Passwords
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_bind_removedUninstall bind Package
- package_gssproxy_removedUninstall gssproxy Package
- package_iprutils_removedUninstall iprutils Package
- package_rng-tools_installedInstall rng-tools Package
- package_rsyslog-gnutls_installedEnsure rsyslog-gnutls is installed
- package_rsyslog_installedEnsure rsyslog is Installed
- package_tuned_removedUninstall tuned Package
- package_vsftpd_removedUninstall vsftpd Package
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- security_patches_up_to_dateEnsure Software Patches Installed
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_debug-shell_disabledDisable debug-shell SystemD Service
- service_firewalld_enabledVerify firewalld Enabled
- service_rngd_enabledEnable the Hardware RNG Entropy Gatherer Service
- service_rsyslog_enabledEnable rsyslog Service
- service_systemd-coredump_disabledDisable acquiring, saving, and processing core dumps
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_disable_x11_forwardingDisable X11 Forwarding
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_print_last_logEnable SSH Print Last Log
- sshd_use_priv_separationEnable Use of Privilege Separation
- sshd_x11_use_localhostPrevent remote hosts from connecting to the proxy display
- sudoers_default_includedirEnsure sudo only includes the default configuration directory
- sudoers_validate_passwdEnsure invoking users password for privilege escalation when using sudo
- sysctl_kernel_core_patternDisable storing core dumps
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
- sysctl_kernel_unprivileged_bpf_disabledDisable Access to Network bpf() Syscall From Unprivileged Processes
- sysctl_kernel_yama_ptrace_scopeRestrict usage of ptrace to descendant processes
- sysctl_net_core_bpf_jit_hardenHarden the operation of the BPF just-in-time compiler
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_user_max_user_namespacesDisable the use of user namespaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- CCI-000368

- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- CCI-000381

- chronyd_client_onlyDisable chrony daemon from acting as server
- chronyd_no_chronyc_networkDisable network management of chrony daemon
- grub2_pti_argumentEnable Kernel Page-Table Isolation (KPTI)
- kernel_module_atm_disabledDisable ATM Support
- kernel_module_can_disabledDisable CAN Support
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_firewire-core_disabledDisable IEEE 1394 (FireWire) Support
- kernel_module_tipc_disabledDisable TIPC Support
- package_abrt-addon-ccpp_removedUninstall abrt-addon-ccpp Package
- package_abrt-addon-kerneloops_removedUninstall abrt-addon-kerneloops Package
- package_abrt-cli_removedUninstall abrt-cli Package
- package_abrt-plugin-logger_removedUninstall abrt-plugin-logger Package
- package_abrt-plugin-rhtsupport_removedUninstall abrt-plugin-rhtsupport Package
- package_abrt-plugin-sosreport_removedUninstall abrt-plugin-sosreport Package
- package_abrt_removedUninstall Automatic Bug Reporting Tool (abrt)
- package_gssproxy_removedUninstall gssproxy Package
- package_libreport-plugin-logger_removedUninstall libreport-plugin-logger Package
- package_libreport-plugin-rhtsupport_removedUninstall libreport-plugin-rhtsupport Package
- package_python3-abrt-addon_removedUninstall python3-abrt-addon Package
- package_sendmail_removedUninstall Sendmail Package
- package_vsftpd_removedUninstall vsftpd Package
- service_atd_disabledDisable At Service (atd)

- CCI-000382

- service_firewalld_enabledVerify firewalld Enabled

- CCI-000416

- service_usbguard_enabledEnable the USBGuard Service

- CCI-000764

- account_unique_idEnsure All Accounts on the System Have Unique User IDs
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_insecure_locks_exportsEnsure Insecure File Locking is Not Allowed
- smartcard_authEnable Smart Card Login

- CCI-000765

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- install_smartcard_packagesInstall Smart Card Packages For Multifactor Authentication
- smartcard_authEnable Smart Card Login
- sshd_enable_pubkey_authEnable Public Key Authentication
- sssd_enable_smartcardsEnable Smartcards in SSSD

- CCI-000766

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- smartcard_authEnable Smart Card Login
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_enable_pubkey_authEnable Public Key Authentication

- CCI-000767

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- smartcard_authEnable Smart Card Login
- sshd_enable_pubkey_authEnable Public Key Authentication

- CCI-000768

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- smartcard_authEnable Smart Card Login
- sshd_enable_pubkey_authEnable Public Key Authentication

- CCI-000770

- account_unique_nameEnsure All Accounts on the System Have Unique Names
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- smartcard_authEnable Smart Card Login
- sshd_disable_root_loginDisable SSH Root Login

- CCI-000771

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- smartcard_authEnable Smart Card Login

- CCI-000772

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- smartcard_authEnable Smart Card Login

- CCI-000778

- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- service_autofs_disabledDisable the Automounter

- CCI-000795

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity

- CCI-000803

- accounts_password_all_shadowed_sha512Verify All Account Password Hashes are Shadowed with SHA512
- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
- kerberos_disable_no_keytabDisable Kerberos by removing host keytab
- package_krb5-workstation_removedUninstall krb5-workstation Package
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- CCI-000804

- account_unique_idEnsure All Accounts on the System Have Unique User IDs
- account_unique_nameEnsure All Accounts on the System Have Unique Names

- CCI-000877

- sshd_enable_pamEnable PAM

- CCI-000879

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CCI-000884

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- smartcard_authEnable Smart Card Login

- CCI-001084

- grub2_page_poison_argumentEnable page allocator poisoning
- grub2_slub_debug_argumentEnable SLUB/SLAB allocator poisoning
- grub2_vsyscall_argumentDisable vsyscalls
- package_policycoreutils_installedInstall policycoreutils Package

- CCI-001090

- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- sysctl_kernel_perf_event_paranoidDisallow kernel profiling by unprivileged users

- CCI-001095

- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- CCI-001130

- package_libreswan_installedInstall libreswan Package

- CCI-001131

- package_libreswan_installedInstall libreswan Package

- CCI-001133

- accounts_tmoutSet Interactive Session Timeout
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CCI-001208

- partition_for_homeEnsure /home Located On Separate Partition

- CCI-001227

- security_patches_up_to_dateEnsure Software Patches Installed

- CCI-001233

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- CCI-001239

- install_antivirusInstall Virus Scanning Software

- CCI-001250

- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration

- CCI-001263

- install_hidsInstall Intrusion Detection Software
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- CCI-001311

- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- CCI-001312

- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- CCI-001314

- file_groupowner_var_logVerify Group Who Owns /var/log Directory
- file_groupowner_var_log_messagesVerify Group Who Owns /var/log/messages File
- file_groupowner_var_log_syslogVerify Group Who Owns /var/log/syslog File
- file_owner_var_logVerify User Who Owns /var/log Directory
- file_owner_var_log_messagesVerify User Who Owns /var/log/messages File
- file_owner_var_log_syslogVerify User Who Owns /var/log/syslog File
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_logVerify Permissions on /var/log Directory
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- file_permissions_var_log_messagesVerify Permissions on /var/log/messages File
- file_permissions_var_log_syslogVerify Permissions on /var/log/syslog File
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer

- CCI-001343

- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space

- CCI-001348

- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- CCI-001384

- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-001385

- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-001386

- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-001387

- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-001388

- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-001403

- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- CCI-001404

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- CCI-001405

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- CCI-001436

- no_rsh_trust_filesRemove Rsh Trust Files

- CCI-001443

- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module

- CCI-001444

- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- CCI-001453

- configure_gnutls_tls_crypto_policyConfigure GnuTLS library to use DoD-approved TLS Encryption
- configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
- harden_sshd_ciphers_openssh_conf_crypto_policyConfigure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config
- harden_sshd_macs_openssh_conf_crypto_policyConfigure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config

- CCI-001464

- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- service_auditd_enabledEnable auditd Service

- CCI-001487

- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- service_auditd_enabledEnable auditd Service

- CCI-001493

- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- CCI-001494

- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- CCI-001495

- dir_ownership_binary_dirsVerify that System Executable Have Root Ownership
- dir_permissions_binary_dirsVerify that System Executable Directories Have Restrictive Permissions
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- CCI-001496

- aide_check_audit_toolsConfigure AIDE to Verify the Audit Tools
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- CCI-001499

- dir_group_ownership_library_dirsVerify that Shared Library Directories Have Root Group Ownership
- dir_ownership_library_dirsVerify that Shared Library Directories Have Root Ownership
- dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
- file_groupownership_system_commands_dirsVerify that system commands files are group owned by root
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- root_permissions_syslibrary_filesVerify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.

- CCI-001503

- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces

- CCI-001551

- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- service_bluetooth_disabledDisable Bluetooth Service
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- CCI-001557

- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- CCI-001576

- auditd_data_retention_flushConfigure auditd flush priority

- CCI-001619

- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters

- CCI-001668

- install_antivirusInstall Virus Scanning Software

- CCI-001682

- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts

- CCI-001683

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- CCI-001684

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- CCI-001685

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- CCI-001686

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- CCI-001744

- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- package_aide_installedInstall AIDE

- CCI-001749

- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- rpm_verify_hashesVerify File Hashes with RPM
- sysctl_kernel_kexec_load_disabledDisable Kernel Image Loading

- CCI-001764

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- package_fapolicyd_installedInstall fapolicyd Package

- CCI-001812

- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- CCI-001813

- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- CCI-001814

- package_audit_installedEnsure the audit Subsystem is Installed
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- service_auditd_enabledEnable auditd Service
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- CCI-001849

- grub2_audit_backlog_limit_argumentExtend Audit Backlog Limit for the Audit Daemon
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

- CCI-001851

- auditd_audispd_configure_remote_serverConfigure audispd Plugin To Send Logs To Remote Server
- auditd_audispd_encrypt_sent_recordsEncrypt Audit Records Sent With audispd Plugin
- auditd_name_formatSet hostname as computer node name in audit logs
- auditd_overflow_actionAppropriate Action Must be Setup When the Internal Audit Event Queue is Full
- package_audit-audispd-plugins_installedEnsure the default plugins for the audit dispatcher are Installed
- rsyslog_encrypt_offload_actionsendstreamdriverauthmodeEnsure Rsyslog Authenticates Off-Loaded Audit Records
- rsyslog_encrypt_offload_actionsendstreamdrivermodeEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_encrypt_offload_defaultnetstreamdriverEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- CCI-001855

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space

- CCI-001875

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001876

- service_auditd_enabledEnable auditd Service

- CCI-001877

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001878

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001879

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001880

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001881

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001882

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001889

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001891

- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- chronyd_server_directiveEnsure Chrony is only configured with the server directive
- chronyd_specify_remote_serverA remote time server for Chrony is configured

- CCI-001914

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001948

- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- install_smartcard_packagesInstall Smart Card Packages For Multifactor Authentication
- sssd_certificate_verificationCertificate certificate status checking in SSSD

- CCI-001953

- install_smartcard_packagesInstall Smart Card Packages For Multifactor Authentication
- package_opensc_installedInstall the opensc Package For Multifactor Authentication

- CCI-001954

- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- install_smartcard_packagesInstall Smart Card Packages For Multifactor Authentication
- package_opensc_installedInstall the opensc Package For Multifactor Authentication
- package_pcsc-lite_installedInstall the pcsc-lite package
- service_pcscd_enabledEnable the pcscd Service
- sssd_enable_smartcardsEnable Smartcards in SSSD

- CCI-001958

- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- package_usbguard_installedInstall usbguard Package
- service_autofs_disabledDisable the Automounter
- service_usbguard_enabledEnable the USBGuard Service

- CCI-002007

- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts

- CCI-002038

- disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- CCI-002046

- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval

- CCI-002130

- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- CCI-002132

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- CCI-002165

- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

- CCI-002227

- sudoers_validate_passwdEnsure invoking users password for privilege escalation when using sudo

- CCI-002234

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

- CCI-002236

- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts

- CCI-002237

- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts

- CCI-002238

- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts

- CCI-002314

- service_firewalld_enabledVerify firewalld Enabled

- CCI-002361

- accounts_tmoutSet Interactive Session Timeout
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CCI-002418

- package_openssh-server_installedInstall the OpenSSH Server Package
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- CCI-002420

- package_openssh-server_installedInstall the OpenSSH Server Package

- CCI-002421

- package_openssh-server_installedInstall the OpenSSH Server Package
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- CCI-002422

- package_openssh-server_installedInstall the OpenSSH Server Package

- CCI-002450

- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- CCI-002530

- sysctl_kernel_exec_shieldEnable ExecShield via sysctl

- CCI-002696

- package_aide_installedInstall AIDE
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing

- CCI-002699

- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- package_aide_installedInstall AIDE

- CCI-002702

- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE

- CCI-002824

- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CCI-002884

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- service_auditd_enabledEnable auditd Service

- hipaa

- 164.308(a)(1)(ii)(B)

- dconf_db_up_to_dateMake sure that the dconf databases are up-to-date with regards to respective keyfiles
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- service_debug-shell_disabledDisable debug-shell SystemD Service

- 164.308(a)(1)(ii)(D)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_retention_flushConfigure auditd flush priority
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.308(a)(3)

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.308(a)(3)(i)

- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- service_autofs_disabledDisable the Automounter

- 164.308(a)(3)(ii)(A)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- service_autofs_disabledDisable the Automounter

- 164.308(a)(4)

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.308(a)(4)(i)

- configure_crypto_policyConfigure System Cryptography Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- dconf_gnome_remote_access_credential_promptRequire Credential Prompting for Remote Access in GNOME3
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- disable_host_authDisable Host-Based Authentication
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- 164.308(a)(5)(ii)(A)

- dconf_db_up_to_dateMake sure that the dconf databases are up-to-date with regards to respective keyfiles

- 164.308(a)(5)(ii)(B)

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- 164.308(a)(5)(ii)(C)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_auditd_enabledEnable auditd Service

- 164.308(a)(6)(ii)

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- 164.308(a)(7)(i)

- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- service_debug-shell_disabledDisable debug-shell SystemD Service

- 164.308(a)(7)(ii)(A)

- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- service_debug-shell_disabledDisable debug-shell SystemD Service

- 164.308(a)(8)

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- 164.308(b)(1)

- configure_crypto_policyConfigure System Cryptography Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- dconf_gnome_remote_access_credential_promptRequire Credential Prompting for Remote Access in GNOME3
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- disable_host_authDisable Host-Based Authentication
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- 164.308(b)(3)

- configure_crypto_policyConfigure System Cryptography Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- dconf_gnome_remote_access_credential_promptRequire Credential Prompting for Remote Access in GNOME3
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- disable_host_authDisable Host-Based Authentication
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- 164.310(a)(1)

- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- service_debug-shell_disabledDisable debug-shell SystemD Service

- 164.310(a)(2)(i)

- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- service_debug-shell_disabledDisable debug-shell SystemD Service

- 164.310(a)(2)(ii)

- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- service_debug-shell_disabledDisable debug-shell SystemD Service

- 164.310(a)(2)(iii)

- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- service_debug-shell_disabledDisable debug-shell SystemD Service

- 164.310(a)(2)(iv)

- audit_rules_immutableMake the auditd Configuration Immutable
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- service_auditd_enabledEnable auditd Service

- 164.310(b)

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_remote_access_credential_promptRequire Credential Prompting for Remote Access in GNOME3
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_rsh_trust_filesRemove Rsh Trust Files
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_debug-shell_disabledDisable debug-shell SystemD Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.310(c)

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_debug-shell_disabledDisable debug-shell SystemD Service
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.310(d)(1)

- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- service_autofs_disabledDisable the Automounter
- service_debug-shell_disabledDisable debug-shell SystemD Service

- 164.310(d)(2)

- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- service_autofs_disabledDisable the Automounter

- 164.310(d)(2)(iii)

- audit_rules_immutableMake the auditd Configuration Immutable
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- service_auditd_enabledEnable auditd Service
- service_debug-shell_disabledDisable debug-shell SystemD Service

- 164.312(a)

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.312(a)(1)

- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- service_autofs_disabledDisable the Automounter

- 164.312(a)(2)(i)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority

- 164.312(a)(2)(ii)

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- package_rsyslog_installedEnsure rsyslog is Installed
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- service_rsyslog_enabledEnable rsyslog Service

- 164.312(a)(2)(iv)

- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- service_autofs_disabledDisable the Automounter

- 164.312(b)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_retention_flushConfigure auditd flush priority
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter

- 164.312(c)(1)

- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- 164.312(c)(2)

- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- 164.312(d)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority

- 164.312(e)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.312(e)(1)

- configure_crypto_policyConfigure System Cryptography Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- dconf_gnome_remote_access_credential_promptRequire Credential Prompting for Remote Access in GNOME3
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- disable_host_authDisable Host-Based Authentication
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- 164.312(e)(2)(i)

- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- 164.312(e)(2)(ii)

- configure_crypto_policyConfigure System Cryptography Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- dconf_gnome_remote_access_credential_promptRequire Credential Prompting for Remote Access in GNOME3
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- disable_host_authDisable Host-Based Authentication
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- 164.314(a)(2)(i)(C)

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- 164.314(a)(2)(iii)

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- isa-62443-2009

- 4.2.3

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- 4.2.3.10

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- service_auditd_enabledEnable auditd Service

- 4.2.3.12

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- 4.2.3.4

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- 4.2.3.7

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- 4.2.3.9

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- 4.3.2.6.7

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- 4.3.3.2.2

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_autofs_disabledDisable the Automounter
- service_nfs_disabledDisable Network File System (nfs)
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts

- 4.3.3.3.7

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer

- 4.3.3.3.9

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- 4.3.3.4

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- 4.3.3.5.1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.5.2

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.5.3

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.5.4

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.5.5

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.5.6

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.5.7

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.5.8

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- avahi_disable_publishingDisable Avahi Publishing
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_sendmail_removedUninstall Sendmail Package
- package_syslogng_installedEnsure syslog-ng is Installed
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.6.1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.6.2

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.6.3

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.6.4

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.6.5

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.6.6

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- 4.3.3.6.7

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.6.8

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.6.9

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.7.1

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.7.2

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.7.3

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_anacronDisable anacron Service
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- umask_for_daemonsSet Daemon Umask
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.3.7.4

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.4.3.2

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.4.3.3

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_defaultRoot Path Must Be Vendor Default
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 4.3.4.3.8

- install_antivirusInstall Virus Scanning Software

- 4.3.4.4.4

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- package_aide_installedInstall AIDE
- rpm_verify_hashesVerify File Hashes with RPM

- 4.3.4.4.7

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- 4.3.4.5.2

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- 4.3.4.5.5

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

- 4.3.4.5.6

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- 4.3.4.5.7

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- 4.3.4.5.8

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- 4.3.4.5.9

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- 4.4.2.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- 4.4.2.2

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- 4.4.2.4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- 4.4.3.2

- install_antivirusInstall Virus Scanning Software
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- 4.4.3.3

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- 4.4.3.4

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- isa-62443-2013

- SR 1.1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 1.10

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 1.11

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 1.12

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 1.13

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- SR 1.2

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 1.3

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 1.4

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 1.5

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 1.6

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 1.7

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 1.8

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 1.9

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- banner_etc_issueModify the System Login Banner
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 2.1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_anacronDisable anacron Service
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- umask_for_daemonsSet Daemon Umask
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 2.10

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- SR 2.11

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- SR 2.12

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- SR 2.2

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 2.3

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 2.4

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 2.5

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 2.6

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- SR 2.7

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SR 2.8

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- SR 2.9

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- SR 3.1

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_hashesVerify File Hashes with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- SR 3.2

- install_antivirusInstall Virus Scanning Software

- SR 3.3

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- install_antivirusInstall Virus Scanning Software
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- rpm_verify_hashesVerify File Hashes with RPM

- SR 3.4

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- install_antivirusInstall Virus Scanning Software
- package_aide_installedInstall AIDE
- rpm_verify_hashesVerify File Hashes with RPM

- SR 3.5

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- SR 3.8

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_hashesVerify File Hashes with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- SR 3.9

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- SR 4.1

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_antivirusInstall Virus Scanning Software
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- SR 4.2

- package_openssh-server_installedInstall the OpenSSH Server Package

- SR 4.3

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- SR 5.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- SR 5.2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- SR 5.3

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- SR 6.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- SR 6.2

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- disable_users_coredumpsDisable Core Dumps for All Users
- install_hidsInstall Intrusion Detection Software
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- SR 7.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- disable_users_coredumpsDisable Core Dumps for All Users
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- SR 7.2

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- disable_users_coredumpsDisable Core Dumps for All Users
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- SR 7.6

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- SR 7.8

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer

- ism

- 0418

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_warn_age_login_defsSet Password Warning Age
- configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
- kerberos_disable_no_keytabDisable Kerberos by removing host keytab
- network_nmcli_permissionsPrevent non-Privileged Users from Modifying Network Interfaces using nmcli
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- sshd_disable_gssapi_authDisable GSSAPI Authentication

- 0421

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- 0422

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- 0431

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- 0487

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- 0582

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- 0584

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- 0586

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- 05885

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- 0846

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- 0940

- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically

- 0957

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- 0974

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- 0988

- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_specify_remote_serverA remote time server for Chrony is configured
- package_chrony_installedThe Chrony package is installed
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- rsyslog_remote_tlsConfigure TLS for rsyslog remote logging
- rsyslog_remote_tls_cacertConfigure CA certificate for rsyslog remote logging
- service_chronyd_enabledThe Chronyd service is enabled
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon

- 1034

- package_aide_installedInstall AIDE

- 1055

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_warn_age_login_defsSet Password Warning Age
- configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
- kerberos_disable_no_keytabDisable Kerberos by removing host keytab
- network_nmcli_permissionsPrevent non-Privileged Users from Modifying Network Interfaces using nmcli
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- sshd_disable_gssapi_authDisable GSSAPI Authentication

- 1144

- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically

- 1173

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- 1288

- package_aide_installedInstall AIDE

- 1311

- snmpd_use_newer_protocolConfigure SNMP Service to Use Only SNMPv3 or Newer

- 1315

- network_ipv6_static_addressManually Assign Global IPv6 Address
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 1319

- network_ipv6_static_addressManually Assign Global IPv6 Address
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- 1341

- package_aide_installedInstall AIDE

- 1382

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- package_opensc_installedInstall the opensc Package For Multifactor Authentication
- package_pcsc-lite_installedInstall the pcsc-lite package
- package_sudo_installedInstall sudo Package
- service_pcscd_enabledEnable the pcscd Service

- 1384

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- package_opensc_installedInstall the opensc Package For Multifactor Authentication
- package_pcsc-lite_installedInstall the pcsc-lite package
- package_sudo_installedInstall sudo Package
- service_pcscd_enabledEnable the pcscd Service

- 1386

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- package_opensc_installedInstall the opensc Package For Multifactor Authentication
- package_pcsc-lite_installedInstall the pcsc-lite package
- package_sudo_installedInstall sudo Package
- service_pcscd_enabledEnable the pcscd Service

- 1401

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- 1402

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_warn_age_login_defsSet Password Warning Age
- configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
- kerberos_disable_no_keytabDisable Kerberos by removing host keytab
- network_nmcli_permissionsPrevent non-Privileged Users from Modifying Network Interfaces using nmcli
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- sshd_disable_gssapi_authDisable GSSAPI Authentication

- 1405

- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_specify_remote_serverA remote time server for Chrony is configured
- package_chrony_installedThe Chrony package is installed
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- rsyslog_remote_tlsConfigure TLS for rsyslog remote logging
- rsyslog_remote_tls_cacertConfigure CA certificate for rsyslog remote logging
- service_chronyd_enabledThe Chronyd service is enabled
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon

- 1410

- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed

- 1416

- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets

- 1417

- package_aide_installedInstall AIDE

- 1418

- package_usbguard_installedInstall usbguard Package
- service_usbguard_enabledEnable the USBGuard Service

- 1446

- configure_crypto_policyConfigure System Cryptography Policy
- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode

- 1449

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- 1467

- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically

- 1472

- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically

- 1483

- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically

- 1491

- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login

- 1493

- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically

- 1494

- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically

- 1495

- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically

- 1504

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- 1505

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- 1506

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- 1546

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- 1557

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- 1558

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- 1559

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- 1560

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- 1561

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- disable_host_authDisable Host-Based Authentication
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit
- sssd_enable_smartcardsEnable Smartcards in SSSD

- iso27001-2013

- A.10.1.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.11.1.2

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer

- A.11.1.4

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.11.1.5

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.11.2.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.11.2.4

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- package_aide_installedInstall AIDE
- package_libreswan_installedInstall libreswan Package
- rpm_verify_hashesVerify File Hashes with RPM

- A.11.2.5

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer

- A.11.2.6

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_rsh_trust_filesRemove Rsh Trust Files
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- A.11.2.9

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp

- A.12.1.1

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- A.12.1.2

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- A.12.1.3

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- disable_users_coredumpsDisable Core Dumps for All Users
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- A.12.1.4

- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- A.12.2.1

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- install_antivirusInstall Virus Scanning Software
- package_aide_installedInstall AIDE
- rpm_verify_hashesVerify File Hashes with RPM

- A.12.4.1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- A.12.4.2

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.12.4.3

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- A.12.4.4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.12.5.1

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- A.12.6.1

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- A.12.6.2

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- A.12.7.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.13.1.1

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- A.13.1.2

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- A.13.1.3

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.13.2.1

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- A.13.2.2

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- A.13.2.3

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.13.2.4

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.14.1.1

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- root_path_defaultRoot Path Must Be Vendor Default
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- A.14.1.2

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.14.1.3

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- A.14.2.1

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- root_path_defaultRoot Path Must Be Vendor Default
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- A.14.2.2

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- A.14.2.3

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- security_patches_up_to_dateEnsure Software Patches Installed
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- A.14.2.4

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- A.14.2.5

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- root_path_defaultRoot Path Must Be Vendor Default
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- A.14.2.7

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.14.2.8

- install_antivirusInstall Virus Scanning Software
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- A.15.1.1

- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- package_libreswan_installedInstall libreswan Package

- A.15.2.1

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_libreswan_installedInstall libreswan Package
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.15.2.2

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.16.1.1

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- A.16.1.2

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- A.16.1.3

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- A.16.1.4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- A.16.1.5

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- A.16.1.6

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- A.16.1.7

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- A.17.2.1

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- disable_users_coredumpsDisable Core Dumps for All Users
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- A.18.1.4

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_passwordSet Boot Loader Password in grub2
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_screen_installedInstall the screen Package
- package_tmux_installedInstall the tmux Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- service_autofs_disabledDisable the Automounter
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.18.2.2

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- A.18.2.3

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- A.6.1.2

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.6.1.3

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

- A.6.1.5

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- root_path_defaultRoot Path Must Be Vendor Default
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- A.6.2.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_rsh_trust_filesRemove Rsh Trust Files
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- A.6.2.2

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_rsh_trust_filesRemove Rsh Trust Files
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- A.7.1.1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_hidsInstall Intrusion Detection Software
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_autofs_disabledDisable the Automounter
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.7.1.2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.7.3.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.8.1.1

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer

- A.8.1.2

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer

- A.8.2.1

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp

- A.8.2.2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.8.2.3

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_antivirusInstall Virus Scanning Software
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.8.3.1

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp

- A.8.3.3

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp

- A.9.1.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.9.1.2

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_anacronDisable anacron Service
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- umask_for_daemonsSet Daemon Umask
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- A.9.2.1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- banner_etc_issueModify the System Login Banner
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_screen_installedInstall the screen Package
- package_tmux_installedInstall the tmux Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_autofs_disabledDisable the Automounter
- service_nfs_disabledDisable Network File System (nfs)
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.2.2

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_passwordSet Boot Loader Password in grub2
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- service_autofs_disabledDisable the Automounter
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.2.3

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_hidsInstall Intrusion Detection Software
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_autofs_disabledDisable the Automounter
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.9.2.4

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_passwordSet Boot Loader Password in grub2
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_screen_installedInstall the screen Package
- package_tmux_installedInstall the tmux Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- service_autofs_disabledDisable the Automounter
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.2.6

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_passwordSet Boot Loader Password in grub2
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- service_autofs_disabledDisable the Automounter
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.3.1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_passwordSet Boot Loader Password in grub2
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_screen_installedInstall the screen Package
- package_tmux_installedInstall the tmux Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- service_autofs_disabledDisable the Automounter
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.4.1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.9.4.2

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_passwordSet Boot Loader Password in grub2
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_screen_installedInstall the screen Package
- package_tmux_installedInstall the tmux Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- service_autofs_disabledDisable the Automounter
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.4.3

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_passwordSet Boot Loader Password in grub2
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_screen_installedInstall the screen Package
- package_tmux_installedInstall the tmux Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- service_autofs_disabledDisable the Automounter
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.4.4

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- A.9.4.5

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- Clause 16.1.2

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- Clause 7.4

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- nerc-cip

- CIP-002-5 R1.1

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-002-5 R1.2

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-003-8 R1.3

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- no_netrc_filesVerify No netrc Files Exist

- CIP-003-8 R3

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- no_netrc_filesVerify No netrc Files Exist

- CIP-003-8 R3.1

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- no_netrc_filesVerify No netrc Files Exist

- CIP-003-8 R3.2

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- no_netrc_filesVerify No netrc Files Exist

- CIP-003-8 R3.3

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- no_netrc_filesVerify No netrc Files Exist

- CIP-003-8 R4

- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

- CIP-003-8 R4.2

- configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
- configure_crypto_policyConfigure System Cryptography Policy
- configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
- configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
- configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- CIP-003-8 R5

- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

- CIP-003-8 R5.1.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-003-8 R5.2

- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing

- CIP-003-8 R5.3

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-003-8 R6

- dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- CIP-004-6 4.1

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-004-6 4.2

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-004-6 R2.2.2

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

- CIP-004-6 R2.2.3

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_tmoutSet Interactive Session Timeout
- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- require_singleuser_authRequire Authentication for Single User Mode
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-004-6 R2.2.4

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-004-6 R2.3

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-004-6 R3

- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

- CIP-004-6 R3.3

- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- package_audit_installedEnsure the audit Subsystem is Installed
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service

- CIP-004-6 R4

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-005-6 R1

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-005-6 R1.1

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-005-6 R1.2

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R.1.3

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

- CIP-007-3 R2.1

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

- CIP-007-3 R2.2

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

- CIP-007-3 R2.3

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

- CIP-007-3 R3

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R3.1

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R4

- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces

- CIP-007-3 R4.1

- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces

- CIP-007-3 R4.2

- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces

- CIP-007-3 R5

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

- CIP-007-3 R5.1

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_tmoutSet Interactive Session Timeout
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
- configure_crypto_policyConfigure System Cryptography Policy
- configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
- configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
- configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces

- CIP-007-3 R5.1.1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

- CIP-007-3 R5.1.2

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R5.1.3

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R5.2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_tmoutSet Interactive Session Timeout
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- require_singleuser_authRequire Authentication for Single User Mode
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CIP-007-3 R5.2.1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R5.2.3

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R5.3.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_tmoutSet Interactive Session Timeout
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- require_singleuser_authRequire Authentication for Single User Mode
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CIP-007-3 R5.3.2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_tmoutSet Interactive Session Timeout
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- require_singleuser_authRequire Authentication for Single User Mode
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CIP-007-3 R5.3.3

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_tmoutSet Interactive Session Timeout
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- require_singleuser_authRequire Authentication for Single User Mode
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CIP-007-3 R6.5

- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- package_audit_installedEnsure the audit Subsystem is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service

- CIP-007-3 R7.1

- configure_crypto_policyConfigure System Cryptography Policy
- configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE

- CIP-007-3 R8.4

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-009-6 R.1.1

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-009-6 R4

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- nist

- AC-10

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User

- AC-11(1)

- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver

- AC-11(1).1

- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver

- AC-11(a)

- configure_tmux_lock_commandConfigure the tmux Lock Command
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period

- AC-11(b)

- configure_tmux_lock_commandConfigure the tmux Lock Command

- AC-12

- accounts_tmoutSet Interactive Session Timeout
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- AC-17(1)

- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- rsyslog_remote_access_monitoringEnsure remote access methods are monitored in Rsyslog
- sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE

- AC-17(2)

- configure_crypto_policyConfigure System Cryptography Policy
- configure_gnutls_tls_crypto_policyConfigure GnuTLS library to use DoD-approved TLS Encryption
- configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- harden_sshd_ciphers_openssh_conf_crypto_policyConfigure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config
- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- harden_sshd_macs_openssh_conf_crypto_policyConfigure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- AC-17(a)

- configure_crypto_policyConfigure System Cryptography Policy
- configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- disable_host_authDisable Host-Based Authentication
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_set_loglevel_infoSet LogLevel to INFO
- sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE
- sshd_use_priv_separationEnable Use of Privilege Separation

- AC-18

- kernel_module_atm_disabledDisable ATM Support
- kernel_module_can_disabledDisable CAN Support
- kernel_module_firewire-core_disabledDisable IEEE 1394 (FireWire) Support

- AC-18(3)

- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- service_bluetooth_disabledDisable Bluetooth Service
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- AC-18(4)

- network_nmcli_permissionsPrevent non-Privileged Users from Modifying Network Interfaces using nmcli

- AC-18(a)

- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- service_bluetooth_disabledDisable Bluetooth Service
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- AC-2(1)

- accounts_password_pam_enforce_localEnsure PAM Enforces Password Requirements - Enforce for Local Accounts Only
- accounts_passwords_pam_faillock_enforce_localEnforce pam_faillock for Local Accounts Only

- AC-2(2)

- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts

- AC-2(3)

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts

- AC-2(4)

- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- AC-2(5)

- accounts_tmoutSet Interactive Session Timeout
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- AC-2(7)(b)

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- AC-2(g)

- service_auditd_enabledEnable auditd Service

- AC-23

- dconf_gnome_disable_user_listDisable the GNOME3 Login User List

- AC-3

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- disable_host_authDisable Host-Based Authentication
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- sshd_limit_user_accessLimit Users' SSH Access

- AC-3(3)(a)

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing

- AC-4

- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

- AC-6

- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_kernel_perf_event_paranoidDisallow kernel profiling by unprivileged users
- sysctl_kernel_unprivileged_bpf_disabledDisable Access to Network bpf() Syscall From Unprivileged Processes

- AC-6(1)

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- sysctl_fs_protected_fifosEnable Kernel Parameter to Enforce DAC on FIFOs
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_regularEnable Kernel Parameter to Enforce DAC on Regular files
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- umask_for_daemonsSet Daemon Umask

- AC-6(2)

- sshd_disable_root_loginDisable SSH Root Login

- AC-6(5)

- accounts_no_uid_except_zeroVerify Only Root Has UID 0

- AC-6(9)

- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_execution_seunshareRecord Any Attempts to Run seunshare
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_atEnsure auditd Collects Information on the Use of Privileged Commands - at
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- directory_access_var_log_auditRecord Access Events to Audit Log Directory
- service_auditd_enabledEnable auditd Service

- AC-7(a)

- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- package_audit_installedEnsure the audit Subsystem is Installed

- AC-7(b)

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts

- AC-8(a)

- banner_etc_issueModify the System Login Banner
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- AC-8(b)

- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner

- AC-8(c)

- banner_etc_issueModify the System Login Banner
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- AC-9

- sshd_print_last_logEnable SSH Print Last Log

- AC-9(1)

- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- AU-10

- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- service_auditd_enabledEnable auditd Service

- AU-11

- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained

- AU-12(2)

- package_audit_installedEnsure the audit Subsystem is Installed

- AU-12(a)

- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd

- AU-12(b)

- file_permissions_etc_audit_auditdVerify Permissions on /etc/audit/auditd.conf
- file_permissions_etc_audit_rulesdVerify Permissions on /etc/audit/rules.d/*.rules

- AU-12(c)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_execution_seunshareRecord Any Attempts to Run seunshare
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_atEnsure auditd Collects Information on the Use of Privileged Commands - at
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_chmodRecord Unsuccessul Permission Changes to Files - chmod
- audit_rules_unsuccessful_file_modification_chownRecord Unsuccessul Ownership Changes to Files - chown
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_fchmodRecord Unsuccessul Permission Changes to Files - fchmod
- audit_rules_unsuccessful_file_modification_fchmodatRecord Unsuccessul Permission Changes to Files - fchmodat
- audit_rules_unsuccessful_file_modification_fchownRecord Unsuccessul Ownership Changes to Files - fchown
- audit_rules_unsuccessful_file_modification_fchownatRecord Unsuccessul Ownership Changes to Files - fchownat
- audit_rules_unsuccessful_file_modification_fremovexattrRecord Unsuccessul Permission Changes to Files - fremovexattr
- audit_rules_unsuccessful_file_modification_fsetxattrRecord Unsuccessul Permission Changes to Files - fsetxattr
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_lchownRecord Unsuccessul Ownership Changes to Files - lchown
- audit_rules_unsuccessful_file_modification_lremovexattrRecord Unsuccessul Permission Changes to Files - lremovexattr
- audit_rules_unsuccessful_file_modification_lsetxattrRecord Unsuccessul Permission Changes to Files - lsetxattr
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_removexattrRecord Unsuccessul Permission Changes to Files - removexattr
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_setxattrRecord Unsuccessul Permission Changes to Files - setxattr
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- directory_access_var_log_auditRecord Access Events to Audit Log Directory
- service_auditd_enabledEnable auditd Service

- AU-12.1(ii)

- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd

- AU-12.1(iv)

- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd

- AU-14

- package_audit_installedEnsure the audit Subsystem is Installed

- AU-14(1)

- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- service_auditd_enabledEnable auditd Service

- AU-2

- configure_usbguard_auditbackendLog USBGuard daemon audit events using Linux Audit

- AU-2(a)

- package_audit_installedEnsure the audit Subsystem is Installed

- AU-2(d)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_execution_seunshareRecord Any Attempts to Run seunshare
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_atEnsure auditd Collects Information on the Use of Privileged Commands - at
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_chmodRecord Unsuccessul Permission Changes to Files - chmod
- audit_rules_unsuccessful_file_modification_chownRecord Unsuccessul Ownership Changes to Files - chown
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_fchmodRecord Unsuccessul Permission Changes to Files - fchmod
- audit_rules_unsuccessful_file_modification_fchmodatRecord Unsuccessul Permission Changes to Files - fchmodat
- audit_rules_unsuccessful_file_modification_fchownRecord Unsuccessul Ownership Changes to Files - fchown
- audit_rules_unsuccessful_file_modification_fchownatRecord Unsuccessul Ownership Changes to Files - fchownat
- audit_rules_unsuccessful_file_modification_fremovexattrRecord Unsuccessul Permission Changes to Files - fremovexattr
- audit_rules_unsuccessful_file_modification_fsetxattrRecord Unsuccessul Permission Changes to Files - fsetxattr
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_lchownRecord Unsuccessul Ownership Changes to Files - lchown
- audit_rules_unsuccessful_file_modification_lremovexattrRecord Unsuccessul Permission Changes to Files - lremovexattr
- audit_rules_unsuccessful_file_modification_lsetxattrRecord Unsuccessul Permission Changes to Files - lsetxattr
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_removexattrRecord Unsuccessul Permission Changes to Files - removexattr
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_setxattrRecord Unsuccessul Permission Changes to Files - setxattr
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- directory_access_var_log_auditRecord Access Events to Audit Log Directory
- service_auditd_enabledEnable auditd Service

- AU-3

- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- auditd_log_formatResolve information before writing to audit logs
- auditd_name_formatSet hostname as computer node name in audit logs
- service_auditd_enabledEnable auditd Service

- AU-3.1

- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd

- AU-4

- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

- AU-4(1)

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_overflow_actionAppropriate Action Must be Setup When the Internal Audit Event Queue is Full
- rsyslog_encrypt_offload_actionsendstreamdriverauthmodeEnsure Rsyslog Authenticates Off-Loaded Audit Records
- rsyslog_encrypt_offload_actionsendstreamdrivermodeEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_encrypt_offload_defaultnetstreamdriverEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- AU-5(1)

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space

- AU-5(2)

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space

- AU-5(4)

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space

- AU-5(a)

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space

- AU-5(b)

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space

- AU-6(3)

- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

- AU-6(4)

- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

- AU-7(1)

- package_audit_installedEnsure the audit Subsystem is Installed

- AU-7(2)

- package_audit_installedEnsure the audit Subsystem is Installed

- AU-8(1)

- chronyd_client_onlyDisable chrony daemon from acting as server

- AU-8(1)(a)

- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- chronyd_specify_remote_serverA remote time server for Chrony is configured
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon

- AU-8(1)(b)

- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval

- AU-8(2)

- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers

- AU-9

- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing

- AU-9(2)

- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- AU-9(3)

- aide_check_audit_toolsConfigure AIDE to Verify the Audit Tools
- auditd_audispd_encrypt_sent_recordsEncrypt Audit Records Sent With audispd Plugin
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_remote_tlsConfigure TLS for rsyslog remote logging

- AU-9(3).1

- aide_check_audit_toolsConfigure AIDE to Verify the Audit Tools

- AU-9(4)

- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive

- CA-3(5)

- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets

- CM-11(a)

- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories

- CM-11(b)

- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories

- CM-5

- dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions

- CM-5(3)

- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories

- CM-5(6)

- dir_group_ownership_library_dirsVerify that Shared Library Directories Have Root Group Ownership
- dir_ownership_library_dirsVerify that Shared Library Directories Have Root Ownership
- dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
- file_groupownership_system_commands_dirsVerify that system commands files are group owned by root
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- root_permissions_syslibrary_filesVerify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.

- CM-5(6).1

- dir_group_ownership_library_dirsVerify that Shared Library Directories Have Root Group Ownership
- dir_ownership_library_dirsVerify that Shared Library Directories Have Root Ownership
- dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
- file_groupownership_system_commands_dirsVerify that system commands files are group owned by root
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- root_permissions_syslibrary_filesVerify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.

- CM-6

- auditd_freqSet number of records to cause an explicit flush to audit logs
- auditd_local_eventsInclude Local Events in Audit Logs
- auditd_log_formatResolve information before writing to audit logs
- auditd_name_formatSet hostname as computer node name in audit logs
- auditd_write_logsWrite Audit Logs to the Disk
- coredump_disable_backtracesDisable core dump backtraces
- coredump_disable_storageDisable storing core dump
- disable_users_coredumpsDisable Core Dumps for All Users
- no_tmux_in_shellsPrevent user from disabling the screen lock
- service_debug-shell_disabledDisable debug-shell SystemD Service
- sysctl_kernel_kexec_load_disabledDisable Kernel Image Loading
- sysctl_net_core_bpf_jit_hardenHarden the operation of the BPF just-in-time compiler

- CM-6(a)

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_dictcheckEnsure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_tmoutSet Interactive Session Timeout
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_execution_seunshareRecord Any Attempts to Run seunshare
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_atEnsure auditd Collects Information on the Use of Privileged Commands - at
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_chmodRecord Unsuccessul Permission Changes to Files - chmod
- audit_rules_unsuccessful_file_modification_chownRecord Unsuccessul Ownership Changes to Files - chown
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_fchmodRecord Unsuccessul Permission Changes to Files - fchmod
- audit_rules_unsuccessful_file_modification_fchmodatRecord Unsuccessul Permission Changes to Files - fchmodat
- audit_rules_unsuccessful_file_modification_fchownRecord Unsuccessul Ownership Changes to Files - fchown
- audit_rules_unsuccessful_file_modification_fchownatRecord Unsuccessul Ownership Changes to Files - fchownat
- audit_rules_unsuccessful_file_modification_fremovexattrRecord Unsuccessul Permission Changes to Files - fremovexattr
- audit_rules_unsuccessful_file_modification_fsetxattrRecord Unsuccessul Permission Changes to Files - fsetxattr
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_lchownRecord Unsuccessul Ownership Changes to Files - lchown
- audit_rules_unsuccessful_file_modification_lremovexattrRecord Unsuccessul Permission Changes to Files - lremovexattr
- audit_rules_unsuccessful_file_modification_lsetxattrRecord Unsuccessul Permission Changes to Files - lsetxattr
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_removexattrRecord Unsuccessul Permission Changes to Files - removexattr
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_setxattrRecord Unsuccessul Permission Changes to Files - setxattr
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_encrypt_sent_recordsEncrypt Audit Records Sent With audispd Plugin
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- avahi_disable_publishingDisable Avahi Publishing
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- chronyd_specify_remote_serverA remote time server for Chrony is configured
- configure_crypto_policyConfigure System Cryptography Policy
- configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- configure_tmux_lock_commandConfigure the tmux Lock Command
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_disable_user_listDisable the GNOME3 Login User List
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- dhcp_server_minimize_served_infoMinimize Served Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_access_var_log_auditRecord Access Events to Audit Log Directory
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_anacronDisable anacron Service
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically
- dnf-automatic_security_updates_onlyConfigure dnf-automatic to Install Only Security Updates
- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_audit_backlog_limit_argumentExtend Audit Backlog Limit for the Audit Daemon
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_page_poison_argumentEnable page allocator poisoning
- grub2_passwordSet Boot Loader Password in grub2
- grub2_slub_debug_argumentEnable SLUB/SLAB allocator poisoning
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- install_antivirusInstall Virus Scanning Software
- install_hidsInstall Intrusion Detection Software
- install_smartcard_packagesInstall Smart Card Packages For Multifactor Authentication
- installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_nmcli_permissionsPrevent non-Privileged Users from Modifying Network Interfaces using nmcli
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- no_rsh_trust_filesRemove Rsh Trust Files
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_audit_installedEnsure the audit Subsystem is Installed
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_fapolicyd_installedInstall fapolicyd Package
- package_gdm_removedRemove the GDM Package Group
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_iptables_installedInstall iptables Package
- package_libreswan_installedInstall libreswan Package
- package_ntp_installedInstall the ntp service
- package_opensc_installedInstall the opensc Package For Multifactor Authentication
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_pcsc-lite_installedInstall the pcsc-lite package
- package_rsyslog_installedEnsure rsyslog is Installed
- package_screen_installedInstall the screen Package
- package_sendmail_removedUninstall Sendmail Package
- package_sudo_installedInstall sudo Package
- package_syslogng_installedEnsure syslog-ng is Installed
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_tmux_installedInstall the tmux Package
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- root_path_defaultRoot Path Must Be Vendor Default
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- rsyslog_remote_tlsConfigure TLS for rsyslog remote logging
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- security_patches_up_to_dateEnsure Software Patches Installed
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_pcscd_enabledEnable the pcscd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_set_loglevel_infoSet LogLevel to INFO
- sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE
- sshd_use_priv_separationEnable Use of Privilege Separation
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1
- sysctl_fs_protected_fifosEnable Kernel Parameter to Enforce DAC on FIFOs
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_regularEnable Kernel Parameter to Enforce DAC on Regular files
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- sysctl_user_max_user_namespacesDisable the use of user namespaces
- timer_dnf-automatic_enabledEnable dnf-automatic Timer
- umask_for_daemonsSet Daemon Umask
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- CM-6(b)

- mount_option_home_noexecAdd noexec Option to /home
- no_empty_passwords_etc_shadowEnsure There Are No Accounts With Blank or Null Passwords
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- sshd_disable_x11_forwardingDisable X11 Forwarding
- sshd_x11_use_localhostPrevent remote hosts from connecting to the proxy display
- sudoers_validate_passwdEnsure invoking users password for privilege escalation when using sudo

- CM-6(c)

- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- CM-6(d)

- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- CM-6.1(iv)

- no_empty_passwords_etc_shadowEnsure There Are No Accounts With Blank or Null Passwords
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- sudoers_validate_passwdEnsure invoking users password for privilege escalation when using sudo

- CM-7

- package_vsftpd_removedUninstall vsftpd Package

- CM-7(1)

- chronyd_no_chronyc_networkDisable network management of chrony daemon

- CM-7(2)

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer

- CM-7(a)

- avahi_disable_publishingDisable Avahi Publishing
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- grub2_vsyscall_argumentDisable vsyscalls
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_gdm_removedRemove the GDM Package Group
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_removedUninstall vsftpd Package
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_nfs_disabledDisable Network File System (nfs)
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- CM-7(b)

- avahi_disable_publishingDisable Avahi Publishing
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_gdm_removedRemove the GDM Package Group
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_removedUninstall vsftpd Package
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- CM-7.1(ii)

- package_vsftpd_removedUninstall vsftpd Package

- CM-8(3)

- configure_usbguard_auditbackendLog USBGuard daemon audit events using Linux Audit
- package_usbguard_installedInstall usbguard Package
- usbguard_allow_hid_and_hubAuthorize Human Interface Devices and USB hubs in USBGuard daemon

- CM-8(3)(a)

- service_usbguard_enabledEnable the USBGuard Service

- IA-11

- disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- IA-2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- no_direct_root_loginsDirect root Logins Not Allowed
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- sshd_disable_root_loginDisable SSH Root Login

- IA-2(1)

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- service_pcscd_enabledEnable the pcscd Service
- smartcard_authEnable Smart Card Login

- IA-2(11)

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- service_pcscd_enabledEnable the pcscd Service
- smartcard_authEnable Smart Card Login
- sssd_certificate_verificationCertificate certificate status checking in SSSD

- IA-2(2)

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- service_pcscd_enabledEnable the pcscd Service
- smartcard_authEnable Smart Card Login

- IA-2(3)

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- service_pcscd_enabledEnable the pcscd Service
- smartcard_authEnable Smart Card Login

- IA-2(4)

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- service_pcscd_enabledEnable the pcscd Service
- smartcard_authEnable Smart Card Login

- IA-2(5)

- sshd_disable_root_loginDisable SSH Root Login

- IA-2(6)

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- service_pcscd_enabledEnable the pcscd Service
- smartcard_authEnable Smart Card Login

- IA-2(7)

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- service_pcscd_enabledEnable the pcscd Service
- smartcard_authEnable Smart Card Login

- IA-2(8)

- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication

- IA-2(9)

- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication

- IA-3

- configure_usbguard_auditbackendLog USBGuard daemon audit events using Linux Audit
- package_usbguard_installedInstall usbguard Package
- service_usbguard_enabledEnable the USBGuard Service
- usbguard_allow_hid_and_hubAuthorize Human Interface Devices and USB hubs in USBGuard daemon

- IA-4(b)

- accounts_no_uid_except_zeroVerify Only Root Has UID 0

- IA-4(e)

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity

- IA-5 (2) (c)

- sssd_enable_certmapEnable Certmap in SSSD

- IA-5(1)

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space

- IA-5(1)(a)

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_dictcheckEnsure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- no_empty_passwordsPrevent Login to Accounts With Empty Password

- IA-5(1)(b)

- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters

- IA-5(1)(c)

- accounts_password_all_shadowed_sha512Verify All Account Password Hashes are Shadowed with SHA512
- no_netrc_filesVerify No netrc Files Exist
- package_vsftpd_removedUninstall vsftpd Package
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- IA-5(1)(d)

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_warn_age_login_defsSet Password Warning Age

- IA-5(1)(e)

- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_unix_rememberLimit Password Reuse

- IA-5(1).1(v)

- accounts_password_all_shadowed_sha512Verify All Account Password Hashes are Shadowed with SHA512
- package_vsftpd_removedUninstall vsftpd Package

- IA-5(13)

- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts

- IA-5(4)

- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_dictcheckEnsure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters

- IA-5(7)

- no_netrc_filesVerify No netrc Files Exist

- IA-5(c)

- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_dictcheckEnsure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm

- IA-5(e)

- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used

- IA-5(f)

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age

- IA-5(h)

- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- no_netrc_filesVerify No netrc Files Exist

- IA-7

- accounts_password_all_shadowed_sha512Verify All Account Password Hashes are Shadowed with SHA512
- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- IA-7.1

- accounts_password_all_shadowed_sha512Verify All Account Password Hashes are Shadowed with SHA512

- IR-5(1)

- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon

- MA-3

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer

- MA-4(1)(a)

- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd

- MA-4(6)

- configure_crypto_policyConfigure System Cryptography Policy
- configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
- configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- MA-6

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported

- MP-7

- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SA-12

- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories

- SA-12(10)

- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories

- SA-13(a)

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported

- SC-10

- accounts_tmoutSet Interactive Session Timeout
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- SC-12

- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- SC-12(2)

- configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
- configure_crypto_policyConfigure System Cryptography Policy
- configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
- configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
- configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- SC-12(3)

- configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
- configure_crypto_policyConfigure System Cryptography Policy
- configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
- configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
- configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- SC-13

- configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
- configure_crypto_policyConfigure System Cryptography Policy
- configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
- configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
- configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- SC-2(1)

- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled

- SC-30

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- SC-30(2)

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- SC-30(5)

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access

- SC-39

- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_user_max_user_namespacesDisable the use of user namespaces

- SC-5

- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces

- SC-5(1)

- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- SC-5(2)

- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- SC-5(3)(a)

- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- SC-7(10)

- disable_users_coredumpsDisable Core Dumps for All Users
- service_systemd-coredump_disabledDisable acquiring, saving, and processing core dumps
- sysctl_kernel_core_patternDisable storing core dumps
- sysctl_kernel_unprivileged_bpf_disabledDisable Access to Network bpf() Syscall From Unprivileged Processes
- sysctl_kernel_yama_ptrace_scopeRestrict usage of ptrace to descendant processes
- sysctl_net_core_bpf_jit_hardenHarden the operation of the BPF just-in-time compiler

- SC-7(21)

- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

- SC-7(23)

- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets

- SC-7(a)

- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces

- SC-8

- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections

- SI-11(a)

- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer

- SI-11(b)

- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer

- SI-16

- grub2_pti_argumentEnable Kernel Page-Table Isolation (KPTI)

- SI-2(5)

- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically
- dnf-automatic_security_updates_onlyConfigure dnf-automatic to Install Only Security Updates
- security_patches_up_to_dateEnsure Software Patches Installed
- timer_dnf-automatic_enabledEnable dnf-automatic Timer

- SI-2(c)

- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically
- dnf-automatic_security_updates_onlyConfigure dnf-automatic to Install Only Security Updates
- security_patches_up_to_dateEnsure Software Patches Installed
- timer_dnf-automatic_enabledEnable dnf-automatic Timer

- SI-4(22)

- package_fapolicyd_installedInstall fapolicyd Package

- SI-4(23)

- service_auditd_enabledEnable auditd Service

- SI-7

- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- SI-7(1)

- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- SI-7(6)

- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- nist-csf

- DE.AE-1

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- DE.AE-2

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.AE-3

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- DE.AE-4

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.AE-5

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- service_auditd_enabledEnable auditd Service

- DE.CM-1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- disable_users_coredumpsDisable Core Dumps for All Users
- install_hidsInstall Intrusion Detection Software
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- DE.CM-3

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- DE.CM-4

- install_antivirusInstall Virus Scanning Software

- DE.CM-5

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.CM-6

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.CM-7

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- DE.DP-2

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.DP-3

- install_antivirusInstall Virus Scanning Software
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.DP-4

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.DP-5

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- ID.AM-1

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer

- ID.AM-3

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- ID.RA-1

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- security_patches_up_to_dateEnsure Software Patches Installed

- ID.SC-4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_data_retention_flushConfigure auditd flush priority
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- PR.AC-1

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_passwordSet Boot Loader Password in grub2
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- service_autofs_disabledDisable the Automounter
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- PR.AC-3

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_rsh_trust_filesRemove Rsh Trust Files
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_bluetooth_disabledDisable Bluetooth Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- PR.AC-4

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_host_authDisable Host-Based Authentication
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_nfs_disabledDisable Network File System (nfs)
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- umask_for_daemonsSet Daemon Umask

- PR.AC-5

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- PR.AC-6

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_automountDisable GNOME3 Automounting
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_autofs_disabledDisable the Automounter
- service_nfs_disabledDisable Network File System (nfs)
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts

- PR.AC-7

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_password_pam_unix_rememberLimit Password Reuse
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- banner_etc_issueModify the System Login Banner
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_passwordSet Boot Loader Password in grub2
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- package_screen_installedInstall the screen Package
- package_tmux_installedInstall the tmux Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- service_autofs_disabledDisable the Automounter
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- smartcard_authEnable Smart Card Login
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- PR.DS-1

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- install_antivirusInstall Virus Scanning Software
- package_aide_installedInstall AIDE

- PR.DS-2

- package_openssh-server_installedInstall the OpenSSH Server Package

- PR.DS-4

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- disable_users_coredumpsDisable Core Dumps for All Users
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- PR.DS-5

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_grub2_cfgVerify /boot/grub2/grub.cfg Permissions
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
- file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- umask_for_daemonsSet Daemon Umask

- PR.DS-6

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- package_aide_installedInstall AIDE
- rpm_verify_hashesVerify File Hashes with RPM

- PR.DS-7

- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- PR.DS-8

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- package_aide_installedInstall AIDE
- rpm_verify_hashesVerify File Hashes with RPM

- PR.IP-1

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- avahi_disable_publishingDisable Avahi Publishing
- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_firewalld_enabledVerify firewalld Enabled
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- PR.IP-12

- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- security_patches_up_to_dateEnsure Software Patches Installed

- PR.IP-2

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- root_path_defaultRoot Path Must Be Vendor Default
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- PR.IP-3

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- package_aide_installedInstall AIDE
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux

- PR.IP-8

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- PR.MA-1

- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer

- PR.MA-2

- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- package_libreswan_installedInstall libreswan Package

- PR.PT-1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_permissionsVerify and Correct File Permissions with RPM
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- PR.PT-2

- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var

- PR.PT-3

- avahi_disable_publishingDisable Avahi Publishing
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- dconf_gnome_disable_thumbnailersDisable All GNOME3 Thumbnailers
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_anacronDisable anacron Service
- disable_host_authDisable Host-Based Authentication
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_freevxfs_disabledDisable Mounting of freevxfs
- kernel_module_hfs_disabledDisable Mounting of hfs
- kernel_module_hfsplus_disabledDisable Mounting of hfsplus
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_jffs2_disabledDisable Mounting of jffs2
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_squashfs_disabledDisable Mounting of squashfs
- kernel_module_tipc_disabledDisable TIPC Support
- kernel_module_udf_disabledDisable Mounting of udf
- kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
- network_disable_zeroconfDisable Zeroconf Networking
- network_ipv6_disable_rpcDisable Support for RPC IPv6
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_bind_removedUninstall bind Package
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_sendmail_removedUninstall Sendmail Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_vsftpd_installedInstall vsftpd Package
- package_vsftpd_removedUninstall vsftpd Package
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_atd_disabledDisable At Service (atd)
- service_bluetooth_disabledDisable Bluetooth Service
- service_cron_enabledEnable cron Service
- service_crond_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_nfs_disabledDisable Network File System (nfs)
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- PR.PT-4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- install_hidsInstall Intrusion Detection Software
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_libreswan_installedInstall libreswan Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_bluetooth_disabledDisable Bluetooth Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
- wireless_disable_interfacesDeactivate Wireless Network Interfaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- RS.AN-1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- RS.AN-4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- service_auditd_enabledEnable auditd Service

- RS.CO-2

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

- RS.CO-3

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- ospp

- FAU_GEN.1

- auditd_freqSet number of records to cause an explicit flush to audit logs
- auditd_local_eventsInclude Local Events in Audit Logs
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_audit_installedEnsure the audit Subsystem is Installed
- service_auditd_enabledEnable auditd Service

- FAU_GEN.1.1.c

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_etc_group_openRecord Events that Modify User/Group Information via open syscall - /etc/group
- audit_rules_etc_group_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
- audit_rules_etc_group_openatRecord Events that Modify User/Group Information via openat syscall - /etc/group
- audit_rules_etc_gshadow_openRecord Events that Modify User/Group Information via open syscall - /etc/gshadow
- audit_rules_etc_gshadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
- audit_rules_etc_gshadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/gshadow
- audit_rules_etc_passwd_openRecord Events that Modify User/Group Information via open syscall - /etc/passwd
- audit_rules_etc_passwd_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
- audit_rules_etc_passwd_openatRecord Events that Modify User/Group Information via openat syscall - /etc/passwd
- audit_rules_etc_shadow_openRecord Events that Modify User/Group Information via open syscall - /etc/shadow
- audit_rules_etc_shadow_open_by_handle_atRecord Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
- audit_rules_etc_shadow_openatRecord Events that Modify User/Group Information via openat syscall - /etc/shadow
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_execution_seunshareRecord Any Attempts to Run seunshare
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_privileged_commands_atEnsure auditd Collects Information on the Use of Privileged Commands - at
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_audispd_configure_remote_serverConfigure audispd Plugin To Send Logs To Remote Server
- auditd_audispd_encrypt_sent_recordsEncrypt Audit Records Sent With audispd Plugin
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- directory_access_var_log_auditRecord Access Events to Audit Log Directory
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- FAU_GEN.1.2

- auditd_log_formatResolve information before writing to audit logs
- auditd_name_formatSet hostname as computer node name in audit logs

- FAU_STG.1

- auditd_write_logsWrite Audit Logs to the Disk
- grub2_audit_backlog_limit_argumentExtend Audit Backlog Limit for the Audit Daemon

- FAU_STG.3

- grub2_audit_backlog_limit_argumentExtend Audit Backlog Limit for the Audit Daemon

- FCS_CKM.1

- configure_crypto_policyConfigure System Cryptography Policy
- enable_fips_modeEnable FIPS Mode

- FCS_CKM.2

- configure_crypto_policyConfigure System Cryptography Policy
- enable_fips_modeEnable FIPS Mode

- FCS_COP.1(1)

- configure_crypto_policyConfigure System Cryptography Policy
- enable_fips_modeEnable FIPS Mode

- FCS_COP.1(2)

- configure_crypto_policyConfigure System Cryptography Policy
- enable_fips_modeEnable FIPS Mode

- FCS_COP.1(3)

- configure_crypto_policyConfigure System Cryptography Policy
- enable_fips_modeEnable FIPS Mode

- FCS_COP.1(4)

- configure_crypto_policyConfigure System Cryptography Policy
- enable_fips_modeEnable FIPS Mode

- FCS_IPSEC_EXT.1.4

- configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy

- FCS_IPSEC_EXT.1.6

- configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy

- FCS_RBG_EXT.1

- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- service_rngd_enabledEnable the Hardware RNG Entropy Gatherer Service

- FCS_SSHC_EXT.1

- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy

- FCS_SSHS_EXT.1

- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- sshd_rekey_limitForce frequent session key renegotiation

- FCS_TLSC_EXT.1

- configure_crypto_policyConfigure System Cryptography Policy
- enable_fips_modeEnable FIPS Mode
- rsyslog_remote_tlsConfigure TLS for rsyslog remote logging
- rsyslog_remote_tls_cacertConfigure CA certificate for rsyslog remote logging

- FIA_AFL.1

- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts

- FIA_UAU.1

- disable_host_authDisable Host-Based Authentication
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode
- service_debug-shell_disabledDisable debug-shell SystemD Service
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts

- FIA_UAU.5

- package_openssh-server_installedInstall the OpenSSH Server Package

- FIA_X509_EXT

- package_gnutls-utils_installedEnsure gnutls-utils is installed

- FIA_X509_EXT.1.1

- rsyslog_remote_tlsConfigure TLS for rsyslog remote logging

- FMT_MOD_EXT.1

- dconf_gnome_disable_user_adminDisable User Administration in GNOME3

- FMT_MOF_EXT.1

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_tmoutSet Interactive Session Timeout
- banner_etc_issueModify the System Login Banner
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- dconf_gnome_login_retriesSet the GNOME3 Login Number of Failures
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- dconf_gnome_screensaver_user_infoDisable Full User Name on Splash Shield
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- package_screen_installedInstall the screen Package
- package_tmux_installedInstall the tmux Package
- security_patches_up_to_dateEnsure Software Patches Installed
- service_firewalld_enabledVerify firewalld Enabled
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets

- FMT_SMF_EXT.1

- chronyd_client_onlyDisable chrony daemon from acting as server
- chronyd_no_chronyc_networkDisable network management of chrony daemon
- configure_bashrc_exec_tmuxSupport session locking with tmux
- configure_tmux_lock_after_timeConfigure tmux to lock session after inactivity
- configure_usbguard_auditbackendLog USBGuard daemon audit events using Linux Audit
- coredump_disable_backtracesDisable core dump backtraces
- coredump_disable_storageDisable storing core dump
- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically
- dnf-automatic_security_updates_onlyConfigure dnf-automatic to Install Only Security Updates
- kernel_module_atm_disabledDisable ATM Support
- kernel_module_can_disabledDisable CAN Support
- kernel_module_firewire-core_disabledDisable IEEE 1394 (FireWire) Support
- kernel_module_tipc_disabledDisable TIPC Support
- no_tmux_in_shellsPrevent user from disabling the screen lock
- package_audispd-plugins_installedInstall audispd-plugins Package
- package_chrony_installedThe Chrony package is installed
- package_nss-tools_installedEnsure nss-tools is installed
- service_systemd-coredump_disabledDisable acquiring, saving, and processing core dumps
- service_usbguard_enabledEnable the USBGuard Service
- sssd_run_as_sssd_userConfigure SSSD to run as user sssd
- sysctl_kernel_core_patternDisable storing core dumps
- sysctl_kernel_perf_event_paranoidDisallow kernel profiling by unprivileged users
- sysctl_kernel_unprivileged_bpf_disabledDisable Access to Network bpf() Syscall From Unprivileged Processes
- sysctl_net_core_bpf_jit_hardenHarden the operation of the BPF just-in-time compiler
- sysctl_user_max_user_namespacesDisable the use of user namespaces
- timer_dnf-automatic_enabledEnable dnf-automatic Timer
- usbguard_allow_hidAuthorize Human Interface Devices in USBGuard daemon
- usbguard_allow_hid_and_hubAuthorize Human Interface Devices and USB hubs in USBGuard daemon
- usbguard_allow_hubAuthorize USB hubs in USBGuard daemon

- FMT_SMF_EXT.1.1

- rsyslog_remote_tlsConfigure TLS for rsyslog remote logging
- use_pam_wheel_for_suEnforce usage of pam_wheel for su authentication

- FPT_ASLR_EXT.1

- grub2_vsyscall_argumentDisable vsyscalls

- FPT_TUD_EXT.1

- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories

- FPT_TUD_EXT.2

- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories

- FTA_TAB.1

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- FTP_ITC_EXT.1

- kerberos_disable_no_keytabDisable Kerberos by removing host keytab
- package_openssh-server_installedInstall the OpenSSH Server Package
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- FTP_ITC_EXT.1.1

- package_rsyslog-gnutls_installedEnsure rsyslog-gnutls is installed
- package_rsyslog_installedEnsure rsyslog is Installed
- rsyslog_remote_tlsConfigure TLS for rsyslog remote logging

- pcidss

- Req-10.1

- service_auditd_enabledEnable auditd Service

- Req-10.2.1

- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat

- Req-10.2.2

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- Req-10.2.3

- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information

- Req-10.2.4

- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- Req-10.2.5

- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- Req-10.2.5.b

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- Req-10.2.7

- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)

- Req-10.3

- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon

- Req-10.4

- package_ntp_installedInstall the ntp service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon

- Req-10.4.1

- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- service_chronyd_or_ntpd_enabledEnable the NTP Daemon

- Req-10.4.2.b

- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File

- Req-10.4.3

- chronyd_or_ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server
- chronyd_specify_remote_serverA remote time server for Chrony is configured
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server

- Req-10.5

- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive

- Req-10.5.1

- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions

- Req-10.5.2

- audit_rules_immutableMake the auditd Configuration Immutable
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions

- Req-10.5.3

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin

- Req-10.5.5

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment

- Req-10.7

- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically

- Req-10.7.a

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space

- Req-11.4

- install_hidsInstall Intrusion Detection Software
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- Req-11.5

- aide_build_databaseBuild and Test AIDE Database
- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- package_aide_installedInstall AIDE
- rpm_verify_hashesVerify File Hashes with RPM
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- Req-4.1

- package_libreswan_installedInstall libreswan Package

- Req-6.2

- ensure_fedora_gpgkey_installedEnsure Fedora GPG Key Installed
- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- security_patches_up_to_dateEnsure Software Patches Installed

- Req-7.1

- file_groupowner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg Group Ownership
- file_groupowner_grub2_cfgVerify /boot/grub2/grub.cfg Group Ownership
- file_owner_efi_grub2_cfgVerify the UEFI Boot Loader grub.cfg User Ownership
- file_owner_grub2_cfgVerify /boot/grub2/grub.cfg User Ownership

- Req-8.1.1

- account_unique_nameEnsure All Accounts on the System Have Unique Names

- Req-8.1.4

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity

- Req-8.1.6

- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts

- Req-8.1.7

- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts

- Req-8.1.8

- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- Req-8.2.1

- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm

- Req-8.2.3

- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters
- no_empty_passwordsPrevent Login to Accounts With Empty Password

- Req-8.2.4

- accounts_maximum_age_login_defsSet Password Maximum Age

- Req-8.2.5

- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_unix_rememberLimit Password Reuse

- Req-8.3

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- smartcard_authEnable Smart Card Login

- Req-8.5.a

- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group

- Req-8.7.c

- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File

- srg

- SRG-OS-000001-GPOS-00001

- accounts_password_pam_enforce_localEnsure PAM Enforces Password Requirements - Enforce for Local Accounts Only
- accounts_passwords_pam_faillock_enforce_localEnforce pam_faillock for Local Accounts Only

- SRG-OS-000002-GPOS-00002

- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts

- SRG-OS-000004-GPOS-00004

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000021-GPOS-00005

- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts

- SRG-OS-000023-GPOS-00006

- banner_etc_issueModify the System Login Banner
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- SRG-OS-000024-GPOS-00007

- banner_etc_issueModify the System Login Banner
- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- SRG-OS-000027-GPOS-00008

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User

- SRG-OS-000028-GPOS-00009

- configure_bashrc_exec_tmuxSupport session locking with tmux
- configure_tmux_lock_commandConfigure the tmux Lock Command
- dconf_gnome_lock_screen_on_smartcard_removalEnable the GNOME3 Screen Locking On Smartcard Removal
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- no_tmux_in_shellsPrevent user from disabling the screen lock
- package_tmux_installedInstall the tmux Package

- SRG-OS-000029-GPOS-00010

- accounts_tmoutSet Interactive Session Timeout
- configure_tmux_lock_after_timeConfigure tmux to lock session after inactivity
- dconf_gnome_screensaver_idle_activation_enabledEnable GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_activation_lockedEnsure Users Cannot Change GNOME3 Screensaver Idle Activation
- dconf_gnome_screensaver_idle_delaySet GNOME3 Screensaver Inactivity Timeout
- dconf_gnome_screensaver_lock_delaySet GNOME3 Screensaver Lock Delay After Activation Period
- dconf_gnome_screensaver_lock_lockedEnsure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
- dconf_gnome_screensaver_user_locksEnsure Users Cannot Change GNOME3 Screensaver Settings
- dconf_gnome_session_idle_user_locksEnsure Users Cannot Change GNOME3 Session Idle Settings
- package_screen_installedInstall the screen Package

- SRG-OS-000030-GPOS-00011

- dconf_gnome_lock_screen_on_smartcard_removalEnable the GNOME3 Screen Locking On Smartcard Removal
- dconf_gnome_screensaver_lock_enabledEnable GNOME3 Screensaver Lock After Idle Period
- package_tmux_installedInstall the tmux Package

- SRG-OS-000031-GPOS-00012

- configure_bashrc_exec_tmuxSupport session locking with tmux
- dconf_gnome_screensaver_mode_blankImplement Blank Screensaver

- SRG-OS-000032-GPOS-00013

- rsyslog_remote_access_monitoringEnsure remote access methods are monitored in Rsyslog
- sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE

- SRG-OS-000033-GPOS-00014

- configure_libreswan_crypto_policyConfigure Libreswan to use System Crypto Policy
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- sshd_rekey_limitForce frequent session key renegotiation
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- SRG-OS-000037-GPOS-00015

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- service_auditd_enabledEnable auditd Service

- SRG-OS-000038-GPOS-00016

- service_auditd_enabledEnable auditd Service

- SRG-OS-000039-GPOS-00017

- auditd_name_formatSet hostname as computer node name in audit logs
- service_auditd_enabledEnable auditd Service

- SRG-OS-000040-GPOS-00018

- service_auditd_enabledEnable auditd Service

- SRG-OS-000041-GPOS-00019

- service_auditd_enabledEnable auditd Service

- SRG-OS-000042-GPOS-00020

- account_unique_idEnsure All Accounts on the System Have Unique User IDs
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon

- SRG-OS-000042-GPOS-00021

- service_auditd_enabledEnable auditd Service

- SRG-OS-000046-GPOS-00022

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account

- SRG-OS-000047-GPOS-00023

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size

- SRG-OS-000051-GPOS-00024

- auditd_freqSet number of records to cause an explicit flush to audit logs
- package_rsyslog_installedEnsure rsyslog is Installed
- service_auditd_enabledEnable auditd Service

- SRG-OS-000054-GPOS-00025

- service_auditd_enabledEnable auditd Service

- SRG-OS-000057-GPOS-00027

- audit_rules_immutableMake the auditd Configuration Immutable
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive

- SRG-OS-000058-GPOS-00028

- audit_rules_immutableMake the auditd Configuration Immutable
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive

- SRG-OS-000059-GPOS-00029

- audit_rules_immutableMake the auditd Configuration Immutable
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive

- SRG-OS-000062-GPOS-00031

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- auditd_local_eventsInclude Local Events in Audit Logs
- configure_usbguard_auditbackendLog USBGuard daemon audit events using Linux Audit
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- package_audit_installedEnsure the audit Subsystem is Installed
- service_auditd_enabledEnable auditd Service

- SRG-OS-000063-GPOS-00032

- file_groupownership_audit_configurationAudit Configuration Files Must Be Owned By Group root
- file_ownership_audit_configurationAudit Configuration Files Must Be Owned By Root
- file_permissions_etc_audit_auditdVerify Permissions on /etc/audit/auditd.conf
- file_permissions_etc_audit_rulesdVerify Permissions on /etc/audit/rules.d/*.rules

- SRG-OS-000064-GPOS-0003

- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su

- SRG-OS-000064-GPOS-00033

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat

- SRG-OS-000068-GPOS-00036

- sssd_enable_certmapEnable Certmap in SSSD

- SRG-OS-000069-GPOS-00037

- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters

- SRG-OS-000070-GPOS-00038

- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters

- SRG-OS-000071-GPOS-00039

- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters
- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User

- SRG-OS-000072-GPOS-00040

- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_maxclassrepeatEnsure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
- accounts_password_pam_maxrepeatSet Password Maximum Consecutive Repeating Characters
- accounts_password_pam_minclassEnsure PAM Enforces Password Requirements - Minimum Different Categories

- SRG-OS-000073-GPOS-00041

- accounts_password_all_shadowed_sha512Verify All Account Password Hashes are Shadowed with SHA512
- accounts_password_pam_unix_rounds_password_authSet number of Password Hashing Rounds - password-auth
- accounts_password_pam_unix_rounds_system_authSet number of Password Hashing Rounds - system-auth
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm

- SRG-OS-000074-GPOS-00042

- package_vsftpd_removedUninstall vsftpd Package
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- SRG-OS-000075-GPOS-00043

- accounts_minimum_age_login_defsSet Password Minimum Age

- SRG-OS-000076-GPOS-00044

- accounts_maximum_age_login_defsSet Password Maximum Age

- SRG-OS-000077-GPOS-00045

- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_unix_rememberLimit Password Reuse

- SRG-OS-000078-GPOS-00046

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length

- SRG-OS-000080-GPOS-00048

- grub2_admin_usernameSet the Boot Loader Admin Username to a Non-Default Value
- grub2_passwordSet Boot Loader Password in grub2
- grub2_uefi_admin_usernameSet the UEFI Boot Loader Admin Username to a Non-Default Value
- grub2_uefi_passwordSet the UEFI Boot Loader Password
- require_emergency_target_authRequire Authentication for Emergency Systemd Target
- require_singleuser_authRequire Authentication for Single User Mode

- SRG-OS-000095-GPOS-00049

- chronyd_client_onlyDisable chrony daemon from acting as server
- chronyd_no_chronyc_networkDisable network management of chrony daemon
- grub2_pti_argumentEnable Kernel Page-Table Isolation (KPTI)
- kernel_module_atm_disabledDisable ATM Support
- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- kernel_module_can_disabledDisable CAN Support
- kernel_module_cramfs_disabledDisable Mounting of cramfs
- kernel_module_firewire-core_disabledDisable IEEE 1394 (FireWire) Support
- kernel_module_tipc_disabledDisable TIPC Support
- package_abrt-addon-ccpp_removedUninstall abrt-addon-ccpp Package
- package_abrt-addon-kerneloops_removedUninstall abrt-addon-kerneloops Package
- package_abrt-cli_removedUninstall abrt-cli Package
- package_abrt-plugin-logger_removedUninstall abrt-plugin-logger Package
- package_abrt-plugin-rhtsupport_removedUninstall abrt-plugin-rhtsupport Package
- package_abrt-plugin-sosreport_removedUninstall abrt-plugin-sosreport Package
- package_abrt_removedUninstall Automatic Bug Reporting Tool (abrt)
- package_gssproxy_removedUninstall gssproxy Package
- package_iprutils_removedUninstall iprutils Package
- package_krb5-workstation_removedUninstall krb5-workstation Package
- package_libreport-plugin-logger_removedUninstall libreport-plugin-logger Package
- package_libreport-plugin-rhtsupport_removedUninstall libreport-plugin-rhtsupport Package
- package_nfs-utils_removedUninstall nfs-utils Package
- package_python3-abrt-addon_removedUninstall python3-abrt-addon Package
- package_sendmail_removedUninstall Sendmail Package
- package_tuned_removedUninstall tuned Package
- package_vsftpd_removedUninstall vsftpd Package

- SRG-OS-000096-GPOS-00050

- chronyd_client_onlyDisable chrony daemon from acting as server
- chronyd_no_chronyc_networkDisable network management of chrony daemon
- kernel_module_dccp_disabledDisable DCCP Support
- service_firewalld_enabledVerify firewalld Enabled

- SRG-OS-000104-GPOS-00051

- account_unique_idEnsure All Accounts on the System Have Unique User IDs
- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- smartcard_authEnable Smart Card Login

- SRG-OS-000105-GPOS-00052

- install_smartcard_packagesInstall Smart Card Packages For Multifactor Authentication
- sshd_enable_pubkey_authEnable Public Key Authentication
- sssd_enable_smartcardsEnable Smartcards in SSSD

- SRG-OS-000106-GPOS-00053

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- smartcard_authEnable Smart Card Login
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_enable_pubkey_authEnable Public Key Authentication

- SRG-OS-000107-GPOS-00054

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- smartcard_authEnable Smart Card Login
- sshd_enable_pubkey_authEnable Public Key Authentication

- SRG-OS-000108-GPOS-00055

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- smartcard_authEnable Smart Card Login
- sshd_enable_pubkey_authEnable Public Key Authentication

- SRG-OS-000108-GPOS-00057

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- smartcard_authEnable Smart Card Login

- SRG-OS-000108-GPOS-00058

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- smartcard_authEnable Smart Card Login

- SRG-OS-000109-GPOS-00056

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- smartcard_authEnable Smart Card Login
- sshd_disable_root_loginDisable SSH Root Login

- SRG-OS-000114-GPOS-00059

- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- service_autofs_disabledDisable the Automounter
- usbguard_allow_hidAuthorize Human Interface Devices in USBGuard daemon
- usbguard_allow_hid_and_hubAuthorize Human Interface Devices and USB hubs in USBGuard daemon
- usbguard_allow_hubAuthorize USB hubs in USBGuard daemon

- SRG-OS-000118-GPOS-00060

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity

- SRG-OS-000120-GPOS-00061

- accounts_password_all_shadowed_sha512Verify All Account Password Hashes are Shadowed with SHA512
- configure_kerberos_crypto_policyConfigure Kerberos to use System Crypto Policy
- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- kerberos_disable_no_keytabDisable Kerberos by removing host keytab
- package_krb5-workstation_removedUninstall krb5-workstation Package
- package_libreswan_installedInstall libreswan Package
- package_rsyslog-gnutls_installedEnsure rsyslog-gnutls is installed
- rsyslog_remote_tlsConfigure TLS for rsyslog remote logging

- SRG-OS-000121-GPOS-00062

- account_unique_idEnsure All Accounts on the System Have Unique User IDs

- SRG-OS-000122-GPOS-00063

- package_audit_installedEnsure the audit Subsystem is Installed
- service_auditd_enabledEnable auditd Service

- SRG-OS-000123-GPOS-00064

- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts

- SRG-OS-000125-GPOS-00065

- sshd_enable_pamEnable PAM
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- SRG-OS-000126-GPOS-00066

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval

- SRG-OS-000132-GPOS-00067

- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_perf_event_paranoidDisallow kernel profiling by unprivileged users
- sysctl_kernel_unprivileged_bpf_disabledDisable Access to Network bpf() Syscall From Unprivileged Processes
- sysctl_kernel_yama_ptrace_scopeRestrict usage of ptrace to descendant processes

- SRG-OS-000134-GPOS-00068

- grub2_page_poison_argumentEnable page allocator poisoning
- grub2_slub_debug_argumentEnable SLUB/SLAB allocator poisoning
- grub2_vsyscall_argumentDisable vsyscalls

- SRG-OS-000138-GPOS-00069

- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
- sysctl_kernel_perf_event_paranoidDisallow kernel profiling by unprivileged users

- SRG-OS-000142-GPOS-00071

- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- SRG-OS-000163-GPOS-00072

- accounts_tmoutSet Interactive Session Timeout
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- SRG-OS-000191-GPOS-00080

- dnf-automatic_apply_updatesConfigure dnf-automatic to Install Available Updates Automatically
- dnf-automatic_security_updates_onlyConfigure dnf-automatic to Install Only Security Updates
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_dnf-automatic_installedInstall dnf-automatic Package
- package_openscap-scanner_installedInstall openscap-scanner Package
- timer_dnf-automatic_enabledEnable dnf-automatic Timer

- SRG-OS-000196

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- SRG-OS-000206-GPOS-00084

- file_groupowner_var_logVerify Group Who Owns /var/log Directory
- file_groupowner_var_log_messagesVerify Group Who Owns /var/log/messages File
- file_groupowner_var_log_syslogVerify Group Who Owns /var/log/syslog File
- file_owner_var_logVerify User Who Owns /var/log Directory
- file_owner_var_log_messagesVerify User Who Owns /var/log/messages File
- file_owner_var_log_syslogVerify User Who Owns /var/log/syslog File
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_logVerify Permissions on /var/log Directory
- file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
- file_permissions_var_log_messagesVerify Permissions on /var/log/messages File
- file_permissions_var_log_syslogVerify Permissions on /var/log/syslog File

- SRG-OS-000228-GPOS-00088

- dconf_gnome_banner_enabledEnable GNOME3 Login Warning Banner
- dconf_gnome_login_banner_textSet the GNOME3 Login Warning Banner Text
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- SRG-OS-000239-GPOS-00089

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000240-GPOS-00090

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000241-GPOS-00090

- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- SRG-OS-000241-GPOS-00091

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000250-GPOS-00093

- configure_gnutls_tls_crypto_policyConfigure GnuTLS library to use DoD-approved TLS Encryption
- configure_openssl_crypto_policyConfigure OpenSSL library to use System Crypto Policy
- configure_ssh_crypto_policyConfigure SSH to use System Crypto Policy
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- harden_sshd_ciphers_openssh_conf_crypto_policyConfigure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config
- harden_sshd_crypto_policyHarden SSHD Crypto Policy
- harden_sshd_macs_openssh_conf_crypto_policyConfigure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config

- SRG-OS-000254-GPOS-00095

- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- grub2_audit_backlog_limit_argumentExtend Audit Backlog Limit for the Audit Daemon
- service_auditd_enabledEnable auditd Service

- SRG-OS-000255-GPOS-00096

- auditd_log_formatResolve information before writing to audit logs
- service_auditd_enabledEnable auditd Service

- SRG-OS-000256-GPOS-00097

- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- SRG-OS-000257-GPOS-00098

- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- SRG-OS-000258-GPOS-00099

- dir_ownership_binary_dirsVerify that System Executable Have Root Ownership
- dir_permissions_binary_dirsVerify that System Executable Directories Have Restrictive Permissions
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- SRG-OS-000259-GPOS-00100

- dir_group_ownership_library_dirsVerify that Shared Library Directories Have Root Group Ownership
- dir_ownership_library_dirsVerify that Shared Library Directories Have Root Ownership
- dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
- file_groupownership_system_commands_dirsVerify that system commands files are group owned by root
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- root_permissions_syslibrary_filesVerify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.

- SRG-OS-000266-GPOS-00101

- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters

- SRG-OS-000274-GPOS-00104

- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd

- SRG-OS-000275-GPOS-00105

- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd

- SRG-OS-000276-GPOS-00106

- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd

- SRG-OS-000277-GPOS-00107

- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd

- SRG-OS-000278-GPOS-00108

- aide_check_audit_toolsConfigure AIDE to Verify the Audit Tools
- rpm_verify_permissionsVerify and Correct File Permissions with RPM

- SRG-OS-000279-GPOS-00109

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- SRG-OS-000297-GPOS-00115

- service_firewalld_enabledVerify firewalld Enabled

- SRG-OS-000299-GPOS-00117

- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SRG-OS-000300-GPOS-00118

- kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SRG-OS-000303-GPOS-00120

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000304-GPOS-00121

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000312-GPOS-00123

- use_pam_wheel_for_suEnforce usage of pam_wheel for su authentication

- SRG-OS-000324-GPOS-00125

- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- no_tmux_in_shellsPrevent user from disabling the screen lock
- package_sudo_installedInstall sudo Package
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- service_debug-shell_disabledDisable debug-shell SystemD Service
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

- SRG-OS-000327-GPOS-00127

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

- SRG-OS-000329-GPOS-00128

- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_deny_rootConfigure the root Account for Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts

- SRG-OS-000337-GPOS-00129

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000341-GPOS-00132

- grub2_audit_backlog_limit_argumentExtend Audit Backlog Limit for the Audit Daemon
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

- SRG-OS-000342-GPOS-00133

- auditd_audispd_configure_remote_serverConfigure audispd Plugin To Send Logs To Remote Server
- auditd_audispd_encrypt_sent_recordsEncrypt Audit Records Sent With audispd Plugin
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_name_formatSet hostname as computer node name in audit logs
- auditd_overflow_actionAppropriate Action Must be Setup When the Internal Audit Event Queue is Full
- package_audispd-plugins_installedInstall audispd-plugins Package
- package_audit-audispd-plugins_installedEnsure the default plugins for the audit dispatcher are Installed
- rsyslog_encrypt_offload_actionsendstreamdriverauthmodeEnsure Rsyslog Authenticates Off-Loaded Audit Records
- rsyslog_encrypt_offload_actionsendstreamdrivermodeEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_encrypt_offload_defaultnetstreamdriverEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- SRG-OS-000343-GPOS-00134

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space

- SRG-OS-000348-GPOS-00136

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000349-GPOS-00137

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000350-GPOS-00138

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000351-GPOS-00139

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000352-GPOS-00140

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000353-GPOS-00141

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000354-GPOS-00142

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000355-GPOS-00143

- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_server_directiveEnsure Chrony is only configured with the server directive
- package_chrony_installedThe Chrony package is installed

- SRG-OS-000356-GPOS-00144

- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_server_directiveEnsure Chrony is only configured with the server directive

- SRG-OS-000358-GPOS-00145

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000359-GPOS-00146

- chronyd_or_ntpd_set_maxpollConfigure Time Service Maxpoll Interval
- chronyd_server_directiveEnsure Chrony is only configured with the server directive
- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000363-GPOS-00150

- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
- package_aide_installedInstall AIDE

- SRG-OS-000364-GPOS-00151

- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- SRG-OS-000365-GPOS-00152

- package_audit_installedEnsure the audit Subsystem is Installed
- service_auditd_enabledEnable auditd Service

- SRG-OS-000366-GPOS-00153

- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories
- sysctl_kernel_kexec_load_disabledDisable Kernel Image Loading

- SRG-OS-000368-GPOS-00154

- mount_option_boot_nodevAdd nodev Option to /boot
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_tmp_nodevAdd nodev Option to /tmp
- mount_option_tmp_noexecAdd noexec Option to /tmp
- mount_option_tmp_nosuidAdd nosuid Option to /tmp
- mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
- mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
- mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
- mount_option_var_log_nodevAdd nodev Option to /var/log
- mount_option_var_log_noexecAdd noexec Option to /var/log
- mount_option_var_log_nosuidAdd nosuid Option to /var/log
- mount_option_var_nodevAdd nodev Option to /var
- package_fapolicyd_installedInstall fapolicyd Package

- SRG-OS-000370-GPOS-00155

- package_fapolicyd_installedInstall fapolicyd Package

- SRG-OS-000373-GPOS-00156

- disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- use_pam_wheel_for_suEnforce usage of pam_wheel for su authentication

- SRG-OS-000373-GPOS-00157

- disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- SRG-OS-000373-GPOS-00158

- disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- SRG-OS-000375-GPOS-00160

- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- install_smartcard_packagesInstall Smart Card Packages For Multifactor Authentication
- package_opensc_installedInstall the opensc Package For Multifactor Authentication
- package_pcsc-lite_installedInstall the pcsc-lite package
- service_pcscd_enabledEnable the pcscd Service
- sssd_certificate_verificationCertificate certificate status checking in SSSD
- sssd_enable_smartcardsEnable Smartcards in SSSD

- SRG-OS-000375-GPOS-00161

- install_smartcard_packagesInstall Smart Card Packages For Multifactor Authentication

- SRG-OS-000376-GPOS-00161

- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- package_opensc_installedInstall the opensc Package For Multifactor Authentication
- smartcard_authEnable Smart Card Login

- SRG-OS-000377-GPOS-00162

- dconf_gnome_enable_smartcard_authEnable the GNOME3 Login Smartcard Authentication
- install_smartcard_packagesInstall Smart Card Packages For Multifactor Authentication
- smartcard_authEnable Smart Card Login
- sssd_certificate_verificationCertificate certificate status checking in SSSD

- SRG-OS-000378-GPOS-00163

- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- kernel_module_dccp_disabledDisable DCCP Support
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- package_usbguard_installedInstall usbguard Package
- service_autofs_disabledDisable the Automounter
- service_usbguard_enabledEnable the USBGuard Service

- SRG-OS-000383-GPOS-00166

- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
- sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts

- SRG-OS-000392-GPOS-00172

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
- service_auditd_enabledEnable auditd Service

- SRG-OS-000393-GPOS-00173

- configure_crypto_policyConfigure System Cryptography Policy
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy

- SRG-OS-000394-GPOS-00174

- configure_crypto_policyConfigure System Cryptography Policy
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy

- SRG-OS-000395-GPOS-00175

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval

- SRG-OS-000396-GPOS-00176

- configure_crypto_policyConfigure System Cryptography Policy
- enable_fips_modeEnable FIPS Mode
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- SRG-OS-000420-GPOS-00186

- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

- SRG-OS-000423-GPOS-00187

- configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
- configure_gnutls_tls_crypto_policyConfigure GnuTLS library to use DoD-approved TLS Encryption
- package_openssh-server_installedInstall the OpenSSH Server Package
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- SRG-OS-000424-GPOS-00188

- package_openssh-server_installedInstall the OpenSSH Server Package
- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- SRG-OS-000425-GPOS-00189

- package_openssh-server_installedInstall the OpenSSH Server Package

- SRG-OS-000426-GPOS-00190

- configure_bind_crypto_policyConfigure BIND to use System Crypto Policy
- package_openssh-server_installedInstall the OpenSSH Server Package

- SRG-OS-000433-GPOS-00192

- bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
- grub2_slub_debug_argumentEnable SLUB/SLAB allocator poisoning
- sysctl_kernel_exec_shieldEnable ExecShield via sysctl
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access

- SRG-OS-000433-GPOS-00193

- grub2_pti_argumentEnable Kernel Page-Table Isolation (KPTI)
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- SRG-OS-000445-GPOS-00199

- package_aide_installedInstall AIDE
- package_libcap-ng-utils_installedInstall libcap-ng-utils Package
- selinux_policytypeConfigure SELinux Policy
- selinux_stateEnsure SELinux State is Enforcing

- SRG-OS-000446-GPOS-00200

- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE

- SRG-OS-000447-GPOS-00201

- aide_periodic_cron_checkingConfigure Periodic Execution of AIDE

- SRG-OS-000458-GPOS-00203

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat

- SRG-OS-000461-GPOS-00205

- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat

- SRG-OS-000462-GPOS-00206

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon

- SRG-OS-000463-GPOS-00207

- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd

- SRG-OS-000465-GPOS-00209

- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool

- SRG-OS-000466-GPOS-00210

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000467-GPOS-00211

- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

- SRG-OS-000468-GPOS-00212

- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat

- SRG-OS-000470-GPOS-00214

- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000471-GPOS-00215

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon

- SRG-OS-000471-GPOS-00216

- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module

- SRG-OS-000473-GPOS-00218

- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon

- SRG-OS-000474-GPOS-00219

- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000475-GPOS-00220

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000476-GPOS-00221

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000477-GPOS-00222

- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module

- SRG-OS-000478-GPOS-00223

- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- SRG-OS-000479-GPOS-00224

- auditd_audispd_configure_remote_serverConfigure audispd Plugin To Send Logs To Remote Server
- auditd_audispd_encrypt_sent_recordsEncrypt Audit Records Sent With audispd Plugin
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_name_formatSet hostname as computer node name in audit logs
- auditd_overflow_actionAppropriate Action Must be Setup When the Internal Audit Event Queue is Full
- package_rsyslog_installedEnsure rsyslog is Installed
- rsyslog_encrypt_offload_actionsendstreamdriverauthmodeEnsure Rsyslog Authenticates Off-Loaded Audit Records
- rsyslog_encrypt_offload_actionsendstreamdrivermodeEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_encrypt_offload_defaultnetstreamdriverEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- SRG-OS-000480-GPOS-00225

- accounts_password_pam_dictcheckEnsure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
- accounts_password_pam_enforce_rootEnsure PAM Enforces Password Requirements - Enforce for root User
- accounts_password_pam_retryEnsure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session

- SRG-OS-000480-GPOS-00226

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs

- SRG-OS-000480-GPOS-00227

- accounts_authorized_local_usersOnly Authorized Local User Accounts Exist on Operating System
- accounts_have_homedir_login_defsEnsure Home Directories are Created for New Users
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_pam_pwquality_password_authEnsure PAM password complexity module is enabled in password-auth
- accounts_password_pam_pwquality_system_authEnsure PAM password complexity module is enabled in system-auth
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- auditd_data_retention_flushConfigure auditd flush priority
- auditd_local_eventsInclude Local Events in Audit Logs
- auditd_log_formatResolve information before writing to audit logs
- auditd_write_logsWrite Audit Logs to the Disk
- coredump_disable_backtracesDisable core dump backtraces
- coredump_disable_storageDisable storing core dump
- dconf_db_up_to_dateMake sure that the dconf databases are up-to-date with regards to respective keyfiles
- dconf_gnome_disable_automount_openDisable GNOME3 Automount Opening
- dconf_gnome_disable_autorunDisable GNOME3 Automount running
- dconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
- dconf_gnome_disable_restart_shutdownDisable the GNOME3 Login Restart and Shutdown Buttons
- dconf_gnome_remote_access_encryptionRequire Encryption for Remote Access in GNOME3
- dir_perms_world_writable_root_ownedEnsure All World-Writable Directories Are Owned by root user
- dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
- dir_perms_world_writable_system_owned_groupEnsure All World-Writable Directories Are Group Owned by a System Account
- disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
- disable_users_coredumpsDisable Core Dumps for All Users
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_ungroupownedEnsure All Files Are Owned by a Group
- grub2_disable_interactive_bootVerify that Interactive Boot is Disabled
- grub2_page_poison_argumentEnable page allocator poisoning
- grub2_vsyscall_argumentDisable vsyscalls
- install_antivirusInstall Virus Scanning Software
- installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
- kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
- libreswan_approved_tunnelsVerify Any Configured IPSec Tunnel Connections
- mount_option_boot_nosuidAdd nosuid Option to /boot
- mount_option_home_noexecAdd noexec Option to /home
- mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
- mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
- mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
- mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
- network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_empty_passwords_etc_shadowEnsure There Are No Accounts With Blank or Null Passwords
- no_files_unowned_by_userEnsure All Files Are Owned by a User
- no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_audit_installedEnsure the audit Subsystem is Installed
- package_gdm_removedRemove the GDM Package Group
- package_gnutls-utils_installedEnsure gnutls-utils is installed
- package_gssproxy_removedUninstall gssproxy Package
- package_iprutils_removedUninstall iprutils Package
- package_iptables_installedInstall iptables Package
- package_libreswan_installedInstall libreswan Package
- package_nss-tools_installedEnsure nss-tools is installed
- package_openscap-scanner_installedInstall openscap-scanner Package
- package_policycoreutils_installedInstall policycoreutils Package
- package_rng-tools_installedInstall rng-tools Package
- package_rsyslog-gnutls_installedEnsure rsyslog-gnutls is installed
- package_rsyslog_installedEnsure rsyslog is Installed
- package_scap-security-guide_installedInstall scap-security-guide Package
- package_sendmail_removedUninstall Sendmail Package
- package_sssd-ipa_installedInstall sssd-ipa Package
- package_tuned_removedUninstall tuned Package
- package_vsftpd_removedUninstall vsftpd Package
- package_xorg-x11-server-common_removedRemove the X Windows Package Group
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rpm_verify_hashesVerify File Hashes with RPM
- rsyslog_cron_loggingEnsure cron Is Logging To Rsyslog
- rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- rsyslog_remote_tlsConfigure TLS for rsyslog remote logging
- rsyslog_remote_tls_cacertConfigure CA certificate for rsyslog remote logging
- security_patches_up_to_dateEnsure Software Patches Installed
- selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
- service_auditd_enabledEnable auditd Service
- service_autofs_disabledDisable the Automounter
- service_debug-shell_disabledDisable debug-shell SystemD Service
- service_firewalld_enabledVerify firewalld Enabled
- service_rngd_enabledEnable the Hardware RNG Entropy Gatherer Service
- service_rsyslog_enabledEnable rsyslog Service
- service_systemd-coredump_disabledDisable acquiring, saving, and processing core dumps
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_disable_x11_forwardingDisable X11 Forwarding
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_print_last_logEnable SSH Print Last Log
- sshd_rekey_limitForce frequent session key renegotiation
- sshd_use_priv_separationEnable Use of Privilege Separation
- sshd_x11_use_localhostPrevent remote hosts from connecting to the proxy display
- sssd_run_as_sssd_userConfigure SSSD to run as user sssd
- sudoers_default_includedirEnsure sudo only includes the default configuration directory
- sudoers_validate_passwdEnsure invoking users password for privilege escalation when using sudo
- sysctl_kernel_core_patternDisable storing core dumps
- sysctl_kernel_kexec_load_disabledDisable Kernel Image Loading
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
- sysctl_kernel_unprivileged_bpf_disabledDisable Access to Network bpf() Syscall From Unprivileged Processes
- sysctl_kernel_yama_ptrace_scopeRestrict usage of ptrace to descendant processes
- sysctl_net_core_bpf_jit_hardenHarden the operation of the BPF just-in-time compiler
- sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
- sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
- sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_log_martiansEnable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
- sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
- sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
- sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
- sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
- sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
- sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
- sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
- sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
- sysctl_user_max_user_namespacesDisable the use of user namespaces
- xwindows_runlevel_targetDisable X Windows Startup By Setting Default Target

- SRG-OS-000480-GPOS-00228

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile

- SRG-OS-000480-GPOS-00229

- disable_host_authDisable Host-Based Authentication
- gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
- gnome_gdm_disable_guest_loginDisable GDM Guest Login
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options

- SRG-OS-000480-GPOS-00231

- service_firewalld_enabledVerify firewalld Enabled

- SRG-OS-000480-GPOS-00232

- service_firewalld_enabledVerify firewalld Enabled

- SRG-OS-000481-GPOS-000481

- wireless_disable_interfacesDeactivate Wireless Network Interfaces

- vmmsrg

- SRG-OS-000002-VMM-000020

- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts

- SRG-OS-000003-VMM-000030

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity

- SRG-OS-000004-VMM-000040

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000021-VMM-000050

- accounts_passwords_pam_faillock_denyLock Accounts After Failed Password Attempts
- accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts

- SRG-OS-000023-VMM-000060

- banner_etc_issueModify the System Login Banner
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- SRG-OS-000024-VMM-000070

- banner_etc_issueModify the System Login Banner
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- SRG-OS-000027-VMM-000080

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User

- SRG-OS-000028-VMM-000090

- configure_tmux_lock_commandConfigure the tmux Lock Command

- SRG-OS-000030-VMM-000110

- configure_tmux_lock_commandConfigure the tmux Lock Command
- package_screen_installedInstall the screen Package
- package_tmux_installedInstall the tmux Package

- SRG-OS-000032-VMM-000130

- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- SRG-OS-000033-VMM-000140

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- SRG-OS-000037-VMM-000150

- service_auditd_enabledEnable auditd Service

- SRG-OS-000038-VMM-000160

- service_auditd_enabledEnable auditd Service

- SRG-OS-000039-VMM-000170

- service_auditd_enabledEnable auditd Service

- SRG-OS-000040-VMM-000180

- service_auditd_enabledEnable auditd Service

- SRG-OS-000041-VMM-000190

- service_auditd_enabledEnable auditd Service

- SRG-OS-000046-VMM-000210

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space

- SRG-OS-000051-VMM-000230

- auditd_audispd_configure_remote_serverConfigure audispd Plugin To Send Logs To Remote Server
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin

- SRG-OS-000058-VMM-000270

- auditd_audispd_configure_remote_serverConfigure audispd Plugin To Send Logs To Remote Server
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin

- SRG-OS-000059-VMM-000280

- auditd_audispd_configure_remote_serverConfigure audispd Plugin To Send Logs To Remote Server
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin

- SRG-OS-000063-VMM-000310

- service_auditd_enabledEnable auditd Service

- SRG-OS-000069-VMM-000360

- accounts_password_pam_ucreditEnsure PAM Enforces Password Requirements - Minimum Uppercase Characters

- SRG-OS-000070-VMM-000370

- accounts_password_pam_lcreditEnsure PAM Enforces Password Requirements - Minimum Lowercase Characters

- SRG-OS-000071-VMM-000380

- accounts_password_pam_dcreditEnsure PAM Enforces Password Requirements - Minimum Digit Characters

- SRG-OS-000072-VMM-000390

- accounts_password_pam_difokEnsure PAM Enforces Password Requirements - Minimum Different Characters
- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length

- SRG-OS-000077-VMM-000440

- accounts_password_pam_pwhistory_remember_password_authLimit Password Reuse: password-auth
- accounts_password_pam_pwhistory_remember_system_authLimit Password Reuse: system-auth
- accounts_password_pam_unix_rememberLimit Password Reuse

- SRG-OS-000078-VMM-000450

- accounts_password_pam_minlenEnsure PAM Enforces Password Requirements - Minimum Length

- SRG-OS-000107-VMM-000530

- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sssd_enable_smartcardsEnable Smartcards in SSSD

- SRG-OS-000118-VMM-000590

- account_disable_post_pw_expirationSet Account Expiration Following Inactivity

- SRG-OS-000120-VMM-000600

- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- SRG-OS-000123-VMM-000620

- account_emergency_expire_dateAssign Expiration Date to Emergency Accounts
- account_temp_expire_dateAssign Expiration Date to Temporary Accounts

- SRG-OS-000163-VMM-000700

- accounts_tmoutSet Interactive Session Timeout

- SRG-OS-000239-VMM-000810

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000240-VMM-000820

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000241-VMM-000830

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000254-VMM-000880

- grub2_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon

- SRG-OS-000266-VMM-000940

- accounts_password_pam_ocreditEnsure PAM Enforces Password Requirements - Minimum Special Characters

- SRG-OS-000274-VMM-000960

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000275-VMM-000970

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000276-VMM-000980

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000277-VMM-000990

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000279-VMM-001010

- accounts_tmoutSet Interactive Session Timeout

- SRG-OS-000303-VMM-001090

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000304-VMM-001100

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000329-VMM-001180

- accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts

- SRG-OS-000341-VMM-001220

- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

- SRG-OS-000343-VMM-001240

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- auditd_data_retention_space_left_percentageConfigure auditd space_left on Low Disk Space

- SRG-OS-000355-VMM-001330

- chronyd_or_ntpd_specify_remote_serverSpecify a Remote NTP Server

- SRG-OS-000356-VMM-001340

- service_chronyd_or_ntpd_enabledEnable the NTP Daemon

- SRG-OS-000366-VMM-001430

- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories

- SRG-OS-000370-VMM-001460

- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories

- SRG-OS-000376-VMM-001520

- configure_opensc_card_driversConfigure opensc Smart Card Drivers
- configure_opensc_nss_dbConfigure NSS DB To Use opensc
- force_opensc_card_driversForce opensc To Use Defined Smart Card Driver
- package_opensc_installedInstall the opensc Package For Multifactor Authentication

- SRG-OS-000377-VMM-001530

- package_pcsc-lite_installedInstall the pcsc-lite package
- service_pcscd_enabledEnable the pcscd Service

- SRG-OS-000383-VMM-001570

- sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
- sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials

- SRG-OS-000396-VMM-001590

- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- SRG-OS-000403-VMM-001640

- configure_opensc_nss_dbConfigure NSS DB To Use opensc

- SRG-OS-000404-VMM-001650

- ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main dnf Configuration
- ensure_gpgcheck_local_packagesEnsure gpgcheck Enabled for Local Packages
- ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All dnf Package Repositories

- SRG-OS-000445-VMM-001780

- coreos_enable_selinux_kernel_argumentEnsure SELinux Not Disabled in the kernel arguments
- grub2_enable_selinuxEnsure SELinux Not Disabled in /etc/default/grub
- selinux_policytypeConfigure SELinux Policy

- SRG-OS-000458-VMM-001810

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_unsuccessful_file_modification_chmodRecord Unsuccessul Permission Changes to Files - chmod
- audit_rules_unsuccessful_file_modification_chownRecord Unsuccessul Ownership Changes to Files - chown
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_fchmodRecord Unsuccessul Permission Changes to Files - fchmod
- audit_rules_unsuccessful_file_modification_fchmodatRecord Unsuccessul Permission Changes to Files - fchmodat
- audit_rules_unsuccessful_file_modification_fchownRecord Unsuccessul Ownership Changes to Files - fchown
- audit_rules_unsuccessful_file_modification_fchownatRecord Unsuccessul Ownership Changes to Files - fchownat
- audit_rules_unsuccessful_file_modification_fremovexattrRecord Unsuccessul Permission Changes to Files - fremovexattr
- audit_rules_unsuccessful_file_modification_fsetxattrRecord Unsuccessul Permission Changes to Files - fsetxattr
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_lchownRecord Unsuccessul Ownership Changes to Files - lchown
- audit_rules_unsuccessful_file_modification_lremovexattrRecord Unsuccessul Permission Changes to Files - lremovexattr
- audit_rules_unsuccessful_file_modification_lsetxattrRecord Unsuccessul Permission Changes to Files - lsetxattr
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_removexattrRecord Unsuccessul Permission Changes to Files - removexattr
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_setxattrRecord Unsuccessul Permission Changes to Files - setxattr
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat

- SRG-OS-000461-VMM-001830

- audit_rules_unsuccessful_file_modification_chmodRecord Unsuccessul Permission Changes to Files - chmod
- audit_rules_unsuccessful_file_modification_chownRecord Unsuccessul Ownership Changes to Files - chown
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_fchmodRecord Unsuccessul Permission Changes to Files - fchmod
- audit_rules_unsuccessful_file_modification_fchmodatRecord Unsuccessul Permission Changes to Files - fchmodat
- audit_rules_unsuccessful_file_modification_fchownRecord Unsuccessul Ownership Changes to Files - fchown
- audit_rules_unsuccessful_file_modification_fchownatRecord Unsuccessul Ownership Changes to Files - fchownat
- audit_rules_unsuccessful_file_modification_fremovexattrRecord Unsuccessul Permission Changes to Files - fremovexattr
- audit_rules_unsuccessful_file_modification_fsetxattrRecord Unsuccessul Permission Changes to Files - fsetxattr
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_lchownRecord Unsuccessul Ownership Changes to Files - lchown
- audit_rules_unsuccessful_file_modification_lremovexattrRecord Unsuccessul Permission Changes to Files - lremovexattr
- audit_rules_unsuccessful_file_modification_lsetxattrRecord Unsuccessul Permission Changes to Files - lsetxattr
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
- audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_orderEnsure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
- audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_open_rule_orderEnsure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
- audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
- audit_rules_unsuccessful_file_modification_openat_rule_orderEnsure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
- audit_rules_unsuccessful_file_modification_removexattrRecord Unsuccessul Permission Changes to Files - removexattr
- audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
- audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
- audit_rules_unsuccessful_file_modification_setxattrRecord Unsuccessul Permission Changes to Files - setxattr
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
- audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat

- SRG-OS-000462-VMM-001840

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- SRG-OS-000463-VMM-001850

- audit_rules_execution_chconRecord Any Attempts to Run chcon
- audit_rules_execution_restoreconRecord Any Attempts to Run restorecon
- audit_rules_execution_semanageRecord Any Attempts to Run semanage
- audit_rules_execution_setseboolRecord Any Attempts to Run setsebool
- audit_rules_execution_seunshareRecord Any Attempts to Run seunshare

- SRG-OS-000466-VMM-001870

- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

- SRG-OS-000468-VMM-001890

- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

- SRG-OS-000470-VMM-001900

- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog

- SRG-OS-000471-VMM-001910

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_privileged_commands_atEnsure auditd Collects Information on the Use of Privileged Commands - at
- audit_rules_privileged_commands_chageEnsure auditd Collects Information on the Use of Privileged Commands - chage
- audit_rules_privileged_commands_chshEnsure auditd Collects Information on the Use of Privileged Commands - chsh
- audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
- audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
- audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
- audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
- audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
- audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
- audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
- audit_rules_privileged_commands_pt_chownEnsure auditd Collects Information on the Use of Privileged Commands - pt_chown
- audit_rules_privileged_commands_ssh_keysignEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
- audit_rules_privileged_commands_suEnsure auditd Collects Information on the Use of Privileged Commands - su
- audit_rules_privileged_commands_sudoEnsure auditd Collects Information on the Use of Privileged Commands - sudo
- audit_rules_privileged_commands_sudoeditEnsure auditd Collects Information on the Use of Privileged Commands - sudoedit
- audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
- audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
- audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
- audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- SRG-OS-000473-VMM-001930

- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog

- SRG-OS-000474-VMM-001940

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr

- SRG-OS-000476-VMM-001960

- audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
- audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
- audit_rules_usergroup_modification_opasswdRecord Events that Modify User/Group Information - /etc/security/opasswd
- audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
- audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow

- SRG-OS-000477-VMM-001970

- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module

- SRG-OS-000478-VMM-001980

- enable_dracut_fips_moduleEnable Dracut FIPS Module
- enable_fips_modeEnable FIPS Mode
- etc_system_fips_existsEnsure '/etc/system-fips' exists
- installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
- sysctl_crypto_fips_enabledSet kernel parameter 'crypto.fips_enabled' to 1

- SRG-OS-000479-VMM-001990

- auditd_audispd_configure_remote_serverConfigure audispd Plugin To Send Logs To Remote Server
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin

- SRG-OS-000480-VMM-002000

- disable_host_authDisable Host-Based Authentication
- security_patches_up_to_dateEnsure Software Patches Installed
- set_firewalld_default_zoneSet Default firewalld Zone for Incoming Packets
- set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
- set_password_hashing_algorithm_passwordauthSet PAM's Password Hashing Algorithm - password-auth
- set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- vsrg

- SRG-OS-000373-VMM-001470

- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- SRG-OS-000373-VMM-001480

- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- SRG-OS-000373-VMM-001490

- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- SRG-OS-000445-VMM-001780

- selinux_stateEnsure SELinux State is Enforcing