## References for product debian11

- anssi

- BP28(R1)

- package_telnetd_removedUninstall the telnet server

- BP28(R10)

- prefer_64bit_osPrefer to use a 64-bit Operating System when supported

- BP28(R11)

- grub2_enable_iommu_forceIOMMU configuration directive

- BP28(R12)

- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_srvEnsure /srv Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition

- BP28(R13)

- file_permissions_systemmapVerify that local System.map file (if exists) is readable only by root

- BP28(R15)

- apt_conf_disallow_unauthenticatedDisable unauthenticated repositories in APT configuration
- apt_sources_list_officialEnsure that official distribution repositories are used

- BP28(R18)

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs

- BP28(R19)

- no_direct_root_loginsDirect root Logins Not Allowed
- sshd_disable_root_loginDisable SSH Root Login

- BP28(R23)

- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- BP28(R29)

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max

- BP28(R35)

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile

- BP28(R36)

- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions

- BP28(R39)

- accounts_polyinstantiated_tmpConfigure Polyinstantiation of /tmp Directories
- accounts_polyinstantiated_var_tmpConfigure Polyinstantiation of /var/tmp Directories

- BP28(R4)

- selinux_stateEnsure SELinux State is Enforcing

- BP28(R40)

- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist

- BP28(R43)

- chronyd_specify_remote_serverA remote time server for Chrony is configured
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- package_chrony_installedThe Chrony package is installed
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

- BP28(R46)

- package_syslogng_installedEnsure syslog-ng is Installed
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- service_syslogng_enabledEnable syslog-ng Service

- BP28(R47)

- partition_for_var_logEnsure /var/log Located On Separate Partition

- BP28(R49)

- postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account

- BP28(R5)

- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- BP28(R50)

- package_audit_installedEnsure the audit Subsystem is Installed
- package_cron_installedInstall the cron service

- BP28(R51)

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- BP28(R58)

- sudo_add_noexecEnsure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC
- sudo_add_requirettyEnsure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty
- sudo_add_use_ptyEnsure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty

- BP28(R59)

- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- BP28(R60)

- sudoers_no_root_targetDon't target root user in the sudoers file

- BP28(R61)

- sudoers_no_command_negationDon't define allowed commands in sudoers by means of exclusion

- BP28(R63)

- sudoers_explicit_command_argsExplicit arguments in sudo specifications

- BP28(R66)

- selinux_stateEnsure SELinux State is Enforcing

- BP28(R7)

- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- NT007(R02)

- package_telnetd-ssl_removedUninstall the ssl compliant telnet server

- NT007(R03)

- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd_removedUninstall the telnet server

- NT007(R1)

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- NT007(R17)

- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords

- NT007(R21)

- sshd_disable_root_loginDisable SSH Root Login

- NT012(R03)

- package_ntp_installedInstall the ntp service
- service_ntp_enabledEnable the NTP Daemon

- NT12(R18)

- ensure_logrotate_activatedEnsure Logrotate Runs Periodically

- NT12(R5)

- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- NT28(R43)

- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- NT28(R46)

- package_rsyslog_installedEnsure rsyslog is Installed
- service_rsyslog_enabledEnable rsyslog Service

- cis

- 9.3.2

- sshd_set_loglevel_infoSet LogLevel to INFO

- 9.3.5

- sshd_set_max_auth_triesSet SSH authentication attempt limit

- cis-csc

- 1

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- 11

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 12

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- 13

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_openssh-server_installedInstall the OpenSSH Server Package
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- 14

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_ntp_installedInstall the ntp service
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 15

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- 16

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- 18

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- 19

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- 2

- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- 20

- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- 3

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- 5

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- 6

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- 7

- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- 8

- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- 9

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- cjis

- 5.10.1.3

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- 5.4.1.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- service_auditd_enabledEnable auditd Service

- 5.5.2

- account_unique_nameEnsure All Accounts on the System Have Unique Names
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_empty_passwordsPrevent Login to Accounts With Empty Password

- 5.5.2.2

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File

- 5.5.6

- disable_host_authDisable Host-Based Authentication
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- 5.6.2.1

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs

- 5.6.2.1.1

- accounts_minimum_age_login_defsSet Password Minimum Age

- cobit5

- APO01.06

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- APO07.06

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- APO08.04

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- APO10.01

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- APO10.03

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- APO10.04

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- APO10.05

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- APO11.04

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- APO11.06

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- APO12.01

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- APO12.02

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- APO12.03

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- APO12.04

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- APO12.06

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- APO13.01

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- APO13.02

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- BAI01.06

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- BAI02.01

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- BAI03.01

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- BAI03.02

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- BAI03.03

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- BAI03.05

- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_aide_installedInstall AIDE
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- BAI03.08

- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- BAI04.04

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- BAI06.01

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- BAI07.04

- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- BAI08.02

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- BAI08.04

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- BAI10.01

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- BAI10.02

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- BAI10.03

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- BAI10.05

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- DSS01.03

- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- DSS01.04

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- service_auditd_enabledEnable auditd Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- DSS01.05

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled

- DSS02.02

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- service_auditd_enabledEnable auditd Service

- DSS02.04

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- DSS02.05

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DSS02.07

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- DSS03.01

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- DSS03.04

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DSS03.05

- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- DSS04.05

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DSS04.07

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- DSS05.01

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DSS05.02

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- DSS05.03

- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- service_auditd_enabledEnable auditd Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- DSS05.04

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- DSS05.05

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- DSS05.06

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

- DSS05.07

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_ntp_installedInstall the ntp service
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- DSS05.10

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- DSS06.01

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DSS06.02

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- DSS06.03

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- selinux_stateEnsure SELinux State is Enforcing
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- DSS06.06

- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- DSS06.10

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- MEA01.01

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- MEA01.02

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- MEA01.03

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- MEA01.04

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- MEA01.05

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- MEA02.01

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- MEA03.03

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- MEA03.04

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- cui

- 3.1.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login

- 3.1.11

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- 3.1.12

- disable_host_authDisable Host-Based Authentication
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_use_priv_separationEnable Use of Privilege Separation

- 3.1.13

- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- 3.1.2

- selinux_stateEnsure SELinux State is Enforcing

- 3.1.20

- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 3.1.5

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login

- 3.1.6

- no_direct_root_loginsDirect root Logins Not Allowed

- 3.1.7

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 3.1.8

- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls

- 3.1.9

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- 3.13.10

- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files

- 3.3.1

- audit_rules_immutableMake the auditd Configuration Immutable
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- service_auditd_enabledEnable auditd Service

- 3.3.2

- service_auditd_enabledEnable auditd Service

- 3.3.6

- service_auditd_enabledEnable auditd Service

- 3.4.3

- audit_rules_immutableMake the auditd Configuration Immutable

- 3.5.10

- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed

- 3.5.4

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- 3.5.6

- accounts_maximum_age_login_defsSet Password Maximum Age

- 3.5.7

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs

- 3.5.8

- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_warn_age_login_defsSet Password Warning Age

- 3.7.2

- selinux_stateEnsure SELinux State is Enforcing

- disa

- CCI-000018

- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- CCI-000048

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-000050

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-000054

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User

- CCI-000067

- sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE

- CCI-000068

- sshd_rekey_limitForce frequent session key renegotiation

- CCI-000126

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- service_auditd_enabledEnable auditd Service

- CCI-000130

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service

- CCI-000131

- service_auditd_enabledEnable auditd Service

- CCI-000132

- service_auditd_enabledEnable auditd Service

- CCI-000133

- service_auditd_enabledEnable auditd Service

- CCI-000134

- service_auditd_enabledEnable auditd Service

- CCI-000135

- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- service_auditd_enabledEnable auditd Service

- CCI-000136

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- CCI-000139

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account

- CCI-000140

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size

- CCI-000154

- service_auditd_enabledEnable auditd Service

- CCI-000158

- service_auditd_enabledEnable auditd Service

- CCI-000160

- chronyd_specify_remote_serverA remote time server for Chrony is configured
- package_ntp_installedInstall the ntp service
- service_ntp_enabledEnable the NTP Daemon

- CCI-000162

- audit_rules_immutableMake the auditd Configuration Immutable
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

- CCI-000163

- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

- CCI-000164

- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

- CCI-000169

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- package_audit_installedEnsure the audit Subsystem is Installed
- service_auditd_enabledEnable auditd Service

- CCI-000171

- file_groupownership_audit_configurationAudit Configuration Files Must Be Owned By Group root
- file_ownership_audit_configurationAudit Configuration Files Must Be Owned By Root

- CCI-000172

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-000196

- no_netrc_filesVerify No netrc Files Exist

- CCI-000197

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- CCI-000198

- accounts_minimum_age_login_defsSet Password Minimum Age

- CCI-000199

- accounts_maximum_age_login_defsSet Password Maximum Age

- CCI-000205

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs

- CCI-000225

- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable

- CCI-000318

- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- CCI-000366

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- auditd_local_eventsInclude Local Events in Audit Logs
- auditd_log_formatResolve information before writing to audit logs
- coredump_disable_backtracesDisable core dump backtraces
- coredump_disable_storageDisable storing core dump
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_empty_passwords_etc_shadowEnsure There Are No Accounts With Blank or Null Passwords
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_rsyslog_installedEnsure rsyslog is Installed
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_disable_x11_forwardingDisable X11 Forwarding
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_print_last_logEnable SSH Print Last Log
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CCI-000368

- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- CCI-000381

- kernel_module_tipc_disabledDisable TIPC Support

- CCI-000764

- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group

- CCI-000765

- sshd_enable_pubkey_authEnable Public Key Authentication

- CCI-000766

- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_enable_pubkey_authEnable Public Key Authentication

- CCI-000767

- sshd_enable_pubkey_authEnable Public Key Authentication

- CCI-000768

- sshd_enable_pubkey_authEnable Public Key Authentication

- CCI-000770

- account_unique_nameEnsure All Accounts on the System Have Unique Names
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- sshd_disable_root_loginDisable SSH Root Login

- CCI-000803

- kerberos_disable_no_keytabDisable Kerberos by removing host keytab

- CCI-000804

- account_unique_nameEnsure All Accounts on the System Have Unique Names

- CCI-000877

- sshd_enable_pamEnable PAM

- CCI-000879

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CCI-001090

- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set

- CCI-001133

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CCI-001208

- partition_for_homeEnsure /home Located On Separate Partition

- CCI-001233

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- CCI-001263

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- CCI-001311

- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- CCI-001312

- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- CCI-001314

- file_groupowner_var_logVerify Group Who Owns /var/log Directory
- file_groupowner_var_log_messagesVerify Group Who Owns /var/log/messages File
- file_groupowner_var_log_syslogVerify Group Who Owns /var/log/syslog File
- file_owner_var_logVerify User Who Owns /var/log Directory
- file_owner_var_log_messagesVerify User Who Owns /var/log/messages File
- file_owner_var_log_syslogVerify User Who Owns /var/log/syslog File
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_logVerify Permissions on /var/log Directory
- file_permissions_var_log_messagesVerify Permissions on /var/log/messages File
- file_permissions_var_log_syslogVerify Permissions on /var/log/syslog File
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions

- CCI-001343

- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space

- CCI-001348

- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- CCI-001384

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-001385

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-001386

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-001387

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-001388

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- CCI-001403

- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- CCI-001436

- no_rsh_trust_filesRemove Rsh Trust Files

- CCI-001464

- service_auditd_enabledEnable auditd Service

- CCI-001487

- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- service_auditd_enabledEnable auditd Service

- CCI-001495

- dir_ownership_binary_dirsVerify that System Executable Have Root Ownership
- dir_permissions_binary_dirsVerify that System Executable Directories Have Restrictive Permissions

- CCI-001499

- dir_ownership_library_dirsVerify that Shared Library Directories Have Root Ownership
- dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions

- CCI-001551

- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- CCI-001557

- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- CCI-001744

- package_aide_installedInstall AIDE

- CCI-001764

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

- CCI-001812

- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- CCI-001813

- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- CCI-001814

- package_audit_installedEnsure the audit Subsystem is Installed
- service_auditd_enabledEnable auditd Service
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- CCI-001849

- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

- CCI-001851

- auditd_name_formatSet hostname as computer node name in audit logs
- auditd_overflow_actionAppropriate Action Must be Setup When the Internal Audit Event Queue is Full
- package_audit-audispd-plugins_installedEnsure the default plugins for the audit dispatcher are Installed
- rsyslog_encrypt_offload_actionsendstreamdriverauthmodeEnsure Rsyslog Authenticates Off-Loaded Audit Records
- rsyslog_encrypt_offload_actionsendstreamdrivermodeEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_encrypt_offload_defaultnetstreamdriverEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- CCI-001855

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space

- CCI-001875

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001876

- service_auditd_enabledEnable auditd Service

- CCI-001877

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001878

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001879

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001880

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001881

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001882

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001889

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-001891

- chronyd_server_directiveEnsure Chrony is only configured with the server directive
- chronyd_specify_remote_serverA remote time server for Chrony is configured

- CCI-001914

- package_audit_installedEnsure the audit Subsystem is Installed

- CCI-002038

- disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- CCI-002130

- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- CCI-002165

- selinux_stateEnsure SELinux State is Enforcing
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

- CCI-002234

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

- CCI-002361

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CCI-002418

- package_openssh-server_installedInstall the OpenSSH Server Package

- CCI-002420

- package_openssh-server_installedInstall the OpenSSH Server Package

- CCI-002421

- package_openssh-server_installedInstall the OpenSSH Server Package

- CCI-002422

- package_openssh-server_installedInstall the OpenSSH Server Package

- CCI-002696

- package_aide_installedInstall AIDE
- selinux_stateEnsure SELinux State is Enforcing

- CCI-002699

- package_aide_installedInstall AIDE

- CCI-002824

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CCI-002884

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- service_auditd_enabledEnable auditd Service

- hipaa

- 164.308(a)(1)(ii)(B)

- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins

- 164.308(a)(1)(ii)(D)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.308(a)(3)

- selinux_stateEnsure SELinux State is Enforcing
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.308(a)(3)(ii)(A)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate

- 164.308(a)(4)

- selinux_stateEnsure SELinux State is Enforcing
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.308(a)(4)(i)

- disable_host_authDisable Host-Based Authentication
- no_rsh_trust_filesRemove Rsh Trust Files
- service_cron_enabledEnable cron Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- 164.308(a)(5)(ii)(B)

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- 164.308(a)(5)(ii)(C)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_auditd_enabledEnable auditd Service

- 164.308(a)(6)(ii)

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- 164.308(a)(7)(i)

- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins

- 164.308(a)(7)(ii)(A)

- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins

- 164.308(a)(8)

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- 164.308(b)(1)

- disable_host_authDisable Host-Based Authentication
- no_rsh_trust_filesRemove Rsh Trust Files
- service_cron_enabledEnable cron Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- 164.308(b)(3)

- disable_host_authDisable Host-Based Authentication
- no_rsh_trust_filesRemove Rsh Trust Files
- service_cron_enabledEnable cron Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- 164.310(a)(1)

- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins

- 164.310(a)(2)(i)

- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins

- 164.310(a)(2)(ii)

- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins

- 164.310(a)(2)(iii)

- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins

- 164.310(a)(2)(iv)

- audit_rules_immutableMake the auditd Configuration Immutable
- service_auditd_enabledEnable auditd Service

- 164.310(b)

- disable_host_authDisable Host-Based Authentication
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_rsh_trust_filesRemove Rsh Trust Files
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.310(c)

- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.310(d)(1)

- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins

- 164.310(d)(2)(iii)

- audit_rules_immutableMake the auditd Configuration Immutable
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- service_auditd_enabledEnable auditd Service

- 164.312(a)

- selinux_stateEnsure SELinux State is Enforcing
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.312(a)(2)(i)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate

- 164.312(a)(2)(ii)

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- package_rsyslog_installedEnsure rsyslog is Installed
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- service_rsyslog_enabledEnable rsyslog Service

- 164.312(b)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_auditd_enabledEnable auditd Service

- 164.312(d)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate

- 164.312(e)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- selinux_stateEnsure SELinux State is Enforcing
- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- 164.312(e)(1)

- disable_host_authDisable Host-Based Authentication
- no_rsh_trust_filesRemove Rsh Trust Files
- service_cron_enabledEnable cron Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- 164.312(e)(2)(ii)

- disable_host_authDisable Host-Based Authentication
- no_rsh_trust_filesRemove Rsh Trust Files
- service_cron_enabledEnable cron Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- 164.314(a)(2)(i)(C)

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- 164.314(a)(2)(iii)

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- isa-62443-2009

- 4.2.3

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- 4.2.3.10

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- service_auditd_enabledEnable auditd Service

- 4.2.3.12

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- 4.2.3.4

- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled

- 4.2.3.7

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- 4.2.3.9

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- 4.3.2.6.7

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- 4.3.3.2.2

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- selinux_stateEnsure SELinux State is Enforcing
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- 4.3.3.3.9

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- 4.3.3.4

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled

- 4.3.3.5.1

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.5.2

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.5.3

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.5.4

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.5.5

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.5.6

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.5.7

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.5.8

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.6.1

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.6.2

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.6.3

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.6.4

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.6.5

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.6.6

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.6.7

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.6.8

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.6.9

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.7.1

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.7.2

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.7.3

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.3.7.4

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.4.3.2

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.4.3.3

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- 4.3.4.4.4

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- 4.3.4.4.7

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- 4.3.4.5.2

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- 4.3.4.5.5

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

- 4.3.4.5.6

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- 4.3.4.5.7

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- 4.3.4.5.8

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- 4.3.4.5.9

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- 4.4.2.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- 4.4.2.2

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- 4.4.2.4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- 4.4.3.2

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- 4.4.3.3

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- 4.4.3.4

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- isa-62443-2013

- SR 1.1

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 1.10

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 1.11

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 1.12

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 1.13

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 1.2

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 1.3

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 1.4

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 1.5

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 1.6

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 1.7

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 1.8

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 1.9

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 2.1

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 2.10

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- SR 2.11

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- SR 2.12

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- SR 2.2

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 2.3

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 2.4

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 2.5

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 2.6

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 2.7

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- SR 2.8

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- SR 2.9

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- SR 3.1

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- SR 3.3

- aide_build_databaseBuild and Test AIDE Database
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE

- SR 3.4

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- SR 3.5

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- SR 3.8

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- SR 3.9

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- SR 4.1

- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- SR 4.2

- package_openssh-server_installedInstall the OpenSSH Server Package

- SR 4.3

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- SR 5.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- SR 5.2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- SR 5.3

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- SR 6.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- SR 6.2

- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- SR 7.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- SR 7.2

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- SR 7.6

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- ism

- 0418

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_warn_age_login_defsSet Password Warning Age
- kerberos_disable_no_keytabDisable Kerberos by removing host keytab
- sshd_disable_gssapi_authDisable GSSAPI Authentication

- 0421

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- 0422

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- 0431

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- 0487

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- 0582

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- 0584

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- 0586

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- 05885

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- 0846

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- 0957

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- 0974

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- 0988

- chronyd_specify_remote_serverA remote time server for Chrony is configured
- package_chrony_installedThe Chrony package is installed
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_chronyd_enabledThe Chronyd service is enabled

- 1034

- package_aide_installedInstall AIDE

- 1055

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_warn_age_login_defsSet Password Warning Age
- kerberos_disable_no_keytabDisable Kerberos by removing host keytab
- sshd_disable_gssapi_authDisable GSSAPI Authentication

- 1173

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- 1288

- package_aide_installedInstall AIDE

- 1311

- service_snmpd_disabledDisable snmpd Service

- 1341

- package_aide_installedInstall AIDE

- 1401

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- 1402

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_warn_age_login_defsSet Password Warning Age
- kerberos_disable_no_keytabDisable Kerberos by removing host keytab
- sshd_disable_gssapi_authDisable GSSAPI Authentication

- 1405

- chronyd_specify_remote_serverA remote time server for Chrony is configured
- package_chrony_installedThe Chrony package is installed
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_chronyd_enabledThe Chronyd service is enabled

- 1410

- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed

- 1417

- package_aide_installedInstall AIDE

- 1449

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- 1504

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- 1505

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- 1506

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- 1546

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- 1557

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- 1558

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- 1559

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- 1560

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- 1561

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- disable_host_authDisable Host-Based Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_set_max_auth_triesSet SSH authentication attempt limit

- iso27001-2013

- A.10.1.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.11.1.4

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.11.1.5

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.11.2.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.11.2.4

- aide_build_databaseBuild and Test AIDE Database
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- package_aide_installedInstall AIDE

- A.11.2.6

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- service_auditd_enabledEnable auditd Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- A.11.2.9

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

- A.12.1.1

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- A.12.1.2

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- A.12.1.3

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.12.1.4

- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- A.12.2.1

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- A.12.4.1

- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- A.12.4.2

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.12.4.3

- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- A.12.4.4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.12.5.1

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- A.12.6.1

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- A.12.6.2

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- A.12.7.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.13.1.1

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.13.1.2

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- A.13.1.3

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.13.2.1

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.13.2.2

- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled

- A.13.2.3

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.13.2.4

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.14.1.1

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- A.14.1.2

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.14.1.3

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.14.2.1

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- A.14.2.2

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- A.14.2.3

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- A.14.2.4

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- A.14.2.5

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- A.14.2.7

- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.14.2.8

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- A.15.1.1

- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

- A.15.2.1

- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.15.2.2

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.16.1.1

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- A.16.1.2

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- A.16.1.3

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- A.16.1.4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- A.16.1.5

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- A.16.1.6

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- A.16.1.7

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- A.17.2.1

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- A.18.1.4

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.18.2.2

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- A.18.2.3

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- A.6.1.2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.6.1.3

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

- A.6.1.5

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- A.6.2.1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- service_auditd_enabledEnable auditd Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- A.6.2.2

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- service_auditd_enabledEnable auditd Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- A.7.1.1

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.7.1.2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.7.3.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.8.2.1

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

- A.8.2.2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.8.2.3

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.8.3.1

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

- A.8.3.3

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

- A.9.1.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.9.1.2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- A.9.2.1

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- selinux_stateEnsure SELinux State is Enforcing
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.2.2

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.2.3

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.2.4

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.2.6

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.3.1

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.4.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.9.4.2

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.4.3

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- A.9.4.4

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- A.9.4.5

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- Clause 16.1.2

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- Clause 7.4

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- nerc-cip

- CIP-002-5 R1.1

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-002-5 R1.2

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-003-8 R1.3

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- no_netrc_filesVerify No netrc Files Exist

- CIP-003-8 R3

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- no_netrc_filesVerify No netrc Files Exist

- CIP-003-8 R3.1

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- no_netrc_filesVerify No netrc Files Exist

- CIP-003-8 R3.2

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- no_netrc_filesVerify No netrc Files Exist

- CIP-003-8 R3.3

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- no_netrc_filesVerify No netrc Files Exist

- CIP-003-8 R4

- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

- CIP-003-8 R4.2

- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- CIP-003-8 R5

- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

- CIP-003-8 R5.1.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-003-8 R5.2

- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing

- CIP-003-8 R5.3

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-003-8 R6

- dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions

- CIP-004-6 4.1

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-004-6 4.2

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-004-6 R2.2.2

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

- CIP-004-6 R2.2.3

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-004-6 R2.2.4

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-004-6 R2.3

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-004-6 R3

- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

- CIP-004-6 R3.3

- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- package_audit_installedEnsure the audit Subsystem is Installed
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service

- CIP-004-6 R4

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-005-6 R1

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-005-6 R1.1

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-005-6 R1.2

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R.1.3

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

- CIP-007-3 R2.1

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

- CIP-007-3 R2.2

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

- CIP-007-3 R2.3

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

- CIP-007-3 R3

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R3.1

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R5

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

- CIP-007-3 R5.1

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R5.1.1

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

- CIP-007-3 R5.1.2

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R5.1.3

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R5.2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CIP-007-3 R5.2.1

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R5.2.3

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-007-3 R5.3.1

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CIP-007-3 R5.3.2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CIP-007-3 R5.3.3

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_netrc_filesVerify No netrc Files Exist
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- CIP-007-3 R6.5

- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- package_audit_installedEnsure the audit Subsystem is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service

- CIP-007-3 R7.1

- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE

- CIP-007-3 R8.4

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-009-6 R.1.1

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- CIP-009-6 R4

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- nist

- AC-10

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User

- AC-12

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- AC-17(1)

- sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE

- AC-17(2)

- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- AC-17(a)

- disable_host_authDisable Host-Based Authentication
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_set_loglevel_infoSet LogLevel to INFO
- sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE
- sshd_use_priv_separationEnable Use of Privilege Separation

- AC-2(4)

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- AC-2(5)

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- AC-2(7)(b)

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- AC-2(g)

- service_auditd_enabledEnable auditd Service

- AC-3

- disable_host_authDisable Host-Based Authentication
- selinux_stateEnsure SELinux State is Enforcing
- sshd_limit_user_accessLimit Users' SSH Access

- AC-3(3)(a)

- selinux_stateEnsure SELinux State is Enforcing

- AC-4

- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

- AC-6

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- AC-6(1)

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

- AC-6(2)

- sshd_disable_root_loginDisable SSH Root Login

- AC-6(5)

- accounts_no_uid_except_zeroVerify Only Root Has UID 0

- AC-6(9)

- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- directory_access_var_log_auditRecord Access Events to Audit Log Directory
- service_auditd_enabledEnable auditd Service

- AC-7(a)

- package_audit_installedEnsure the audit Subsystem is Installed

- AC-7(b)

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs

- AC-8(a)

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- AC-8(c)

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- AC-9

- sshd_print_last_logEnable SSH Print Last Log

- AC-9(1)

- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- AU-10

- service_auditd_enabledEnable auditd Service

- AU-11

- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained

- AU-12(2)

- package_audit_installedEnsure the audit Subsystem is Installed

- AU-12(c)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- directory_access_var_log_auditRecord Access Events to Audit Log Directory
- service_auditd_enabledEnable auditd Service

- AU-14

- package_audit_installedEnsure the audit Subsystem is Installed

- AU-14(1)

- service_auditd_enabledEnable auditd Service

- AU-2(a)

- package_audit_installedEnsure the audit Subsystem is Installed

- AU-2(d)

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- directory_access_var_log_auditRecord Access Events to Audit Log Directory
- service_auditd_enabledEnable auditd Service

- AU-3

- auditd_log_formatResolve information before writing to audit logs
- auditd_name_formatSet hostname as computer node name in audit logs
- service_auditd_enabledEnable auditd Service

- AU-4

- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

- AU-4(1)

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_overflow_actionAppropriate Action Must be Setup When the Internal Audit Event Queue is Full
- rsyslog_encrypt_offload_actionsendstreamdriverauthmodeEnsure Rsyslog Authenticates Off-Loaded Audit Records
- rsyslog_encrypt_offload_actionsendstreamdrivermodeEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_encrypt_offload_defaultnetstreamdriverEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- AU-5(1)

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space

- AU-5(2)

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space

- AU-5(4)

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space

- AU-5(a)

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space

- AU-5(b)

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space

- AU-6(3)

- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

- AU-6(4)

- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server

- AU-7(1)

- package_audit_installedEnsure the audit Subsystem is Installed

- AU-7(2)

- package_audit_installedEnsure the audit Subsystem is Installed

- AU-8(1)(a)

- chronyd_specify_remote_serverA remote time server for Chrony is configured
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon

- AU-8(2)

- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers

- AU-9

- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- selinux_stateEnsure SELinux State is Enforcing

- AU-9(2)

- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- AU-9(4)

- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

- CA-3(5)

- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets

- CM-5

- dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions

- CM-5(6)

- dir_ownership_library_dirsVerify that Shared Library Directories Have Root Ownership
- dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions

- CM-5(6).1

- dir_ownership_library_dirsVerify that Shared Library Directories Have Root Ownership
- dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions

- CM-6

- auditd_freqSet number of records to cause an explicit flush to audit logs
- auditd_local_eventsInclude Local Events in Audit Logs
- auditd_log_formatResolve information before writing to audit logs
- auditd_name_formatSet hostname as computer node name in audit logs
- auditd_write_logsWrite Audit Logs to the Disk
- coredump_disable_backtracesDisable core dump backtraces
- coredump_disable_storageDisable storing core dump

- CM-6(a)

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- avahi_disable_publishingDisable Avahi Publishing
- chronyd_specify_remote_serverA remote time server for Chrony is configured
- dhcp_server_minimize_served_infoMinimize Served Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_access_var_log_auditRecord Access Events to Audit Log Directory
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
- no_rsh_trust_filesRemove Rsh Trust Files
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- package_audit_installedEnsure the audit Subsystem is Installed
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_ntp_installedInstall the ntp service
- package_openssh-server_installedInstall the OpenSSH Server Package
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- service_auditd_enabledEnable auditd Service
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_set_loglevel_infoSet LogLevel to INFO
- sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE
- sshd_use_priv_separationEnable Use of Privilege Separation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- CM-6(b)

- no_empty_passwords_etc_shadowEnsure There Are No Accounts With Blank or Null Passwords
- sshd_disable_x11_forwardingDisable X11 Forwarding

- CM-6.1(iv)

- no_empty_passwords_etc_shadowEnsure There Are No Accounts With Blank or Null Passwords

- CM-7(a)

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- CM-7(b)

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- IA-11

- disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- IA-2

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- sshd_disable_root_loginDisable SSH Root Login

- IA-2(5)

- sshd_disable_root_loginDisable SSH Root Login

- IA-4(b)

- accounts_no_uid_except_zeroVerify Only Root Has UID 0

- IA-5(1)

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space

- IA-5(1)(a)

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- no_empty_passwordsPrevent Login to Accounts With Empty Password

- IA-5(1)(c)

- no_netrc_filesVerify No netrc Files Exist
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- IA-5(1)(d)

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_warn_age_login_defsSet Password Warning Age

- IA-5(7)

- no_netrc_filesVerify No netrc Files Exist

- IA-5(c)

- no_empty_passwordsPrevent Login to Accounts With Empty Password

- IA-5(e)

- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used

- IA-5(f)

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age

- IA-5(h)

- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- no_netrc_filesVerify No netrc Files Exist

- MA-4(6)

- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- MP-7

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

- SC-10

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- SC-13

- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- SC-30

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- SC-30(2)

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- SC-30(5)

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access

- SC-5(2)

- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

- SC-7(21)

- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets

- SC-7(23)

- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets

- SI-11(a)

- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs

- SI-11(b)

- sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs

- SI-4(23)

- service_auditd_enabledEnable auditd Service

- nist-csf

- DE.AE-1

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- DE.AE-2

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.AE-3

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- DE.AE-4

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.AE-5

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- service_auditd_enabledEnable auditd Service

- DE.CM-1

- accounts_password_warn_age_login_defsSet Password Warning Age
- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- DE.CM-3

- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- DE.CM-5

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.CM-6

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.CM-7

- aide_build_databaseBuild and Test AIDE Database
- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_aide_installedInstall AIDE
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- DE.DP-2

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.DP-3

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.DP-4

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- DE.DP-5

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- ID.AM-3

- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled

- ID.RA-1

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- ID.SC-4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- PR.AC-1

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- PR.AC-3

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- service_auditd_enabledEnable auditd Service
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- PR.AC-4

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- disable_host_authDisable Host-Based Authentication
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sshd_use_priv_separationEnable Use of Privilege Separation

- PR.AC-5

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled

- PR.AC-6

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- disable_host_authDisable Host-Based Authentication
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- selinux_stateEnsure SELinux State is Enforcing
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- PR.AC-7

- accounts_maximum_age_login_defsSet Password Maximum Age
- accounts_minimum_age_login_defsSet Password Minimum Age
- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
- accounts_password_warn_age_login_defsSet Password Warning Age
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
- no_direct_root_loginsDirect root Logins Not Allowed
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_netrc_filesVerify No netrc Files Exist
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner
- sshd_print_last_logEnable SSH Print Last Log
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- PR.DS-1

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- PR.DS-2

- package_openssh-server_installedInstall the OpenSSH Server Package

- PR.DS-4

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- PR.DS-5

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- audit_rules_immutableMake the auditd Configuration Immutable
- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_gshadowVerify User Who Owns gshadow File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_gshadowVerify Permissions on gshadow File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File
- file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_openssh-server_installedInstall the OpenSSH Server Package
- restrict_serial_port_loginsRestrict Serial Port Root Logins
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- selinux_stateEnsure SELinux State is Enforcing
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_root_loginDisable SSH Root Login
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_use_priv_separationEnable Use of Privilege Separation

- PR.DS-6

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- PR.DS-7

- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding

- PR.DS-8

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- PR.IP-1

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
- accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- aide_build_databaseBuild and Test AIDE Database
- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_rsh_trust_filesRemove Rsh Trust Files
- package_aide_installedInstall AIDE
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- PR.IP-2

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- PR.IP-3

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- PR.IP-8

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- PR.MA-2

- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

- PR.PT-1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server
- package_ntp_installedInstall the ntp service
- package_rsyslog_installedEnsure rsyslog is Installed
- package_syslogng_installedEnsure syslog-ng is Installed
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
- rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon
- service_rsyslog_enabledEnable rsyslog Service
- service_syslogng_enabledEnable syslog-ng Service

- PR.PT-2

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

- PR.PT-3

- avahi_disable_publishingDisable Avahi Publishing
- dhcp_server_minimize_served_infoMinimize Served Information
- disable_host_authDisable Host-Based Authentication
- kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
- kernel_module_rds_disabledDisable RDS Support
- kernel_module_tipc_disabledDisable TIPC Support
- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
- no_netrc_filesVerify No netrc Files Exist
- no_rsh_trust_filesRemove Rsh Trust Files
- package_cron_installedInstall the cron service
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- selinux_stateEnsure SELinux State is Enforcing
- service_cron_enabledEnable cron Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
- set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
- set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_root_loginDisable SSH Root Login
- sshd_limit_user_accessLimit Users' SSH Access
- sysctl_net_ipv6_conf_all_disable_ipv6Disable IPv6 Addressing on All IPv6 Interfaces
- sysctl_net_ipv6_conf_default_disable_ipv6Disable IPv6 Addressing on IPv6 Interfaces by Default

- PR.PT-4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- no_rsh_trust_filesRemove Rsh Trust Files
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_inetutils-telnetd_removedUninstall the inet-based telnet server
- package_telnetd-ssl_removedUninstall the ssl compliant telnet server
- package_telnetd_removedUninstall the telnet server
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- selinux_stateEnsure SELinux State is Enforcing
- service_auditd_enabledEnable auditd Service
- service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
- service_iptables_enabledVerify iptables Enabled
- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- RS.AN-1

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- service_auditd_enabledEnable auditd Service

- RS.AN-4

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_immutableMake the auditd Configuration Immutable
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- service_auditd_enabledEnable auditd Service

- RS.CO-2

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

- RS.CO-3

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- ospp

- FAU_GEN.1

- auditd_freqSet number of records to cause an explicit flush to audit logs
- auditd_local_eventsInclude Local Events in Audit Logs
- package_audit_installedEnsure the audit Subsystem is Installed
- service_auditd_enabledEnable auditd Service

- FAU_GEN.1.1.c

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- directory_access_var_log_auditRecord Access Events to Audit Log Directory
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- FAU_GEN.1.2

- auditd_log_formatResolve information before writing to audit logs
- auditd_name_formatSet hostname as computer node name in audit logs

- FAU_STG.1

- auditd_write_logsWrite Audit Logs to the Disk

- FCS_SSHC_EXT.1

- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy

- FCS_SSHS_EXT.1

- sshd_rekey_limitForce frequent session key renegotiation

- FIA_UAU.1

- disable_host_authDisable Host-Based Authentication
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts

- FIA_UAU.5

- package_openssh-server_installedInstall the OpenSSH Server Package

- FIA_X509_EXT

- package_gnutls-utils_installedEnsure gnutls-utils is installed

- FMT_MOF_EXT.1

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs

- FMT_SMF_EXT.1

- coredump_disable_backtracesDisable core dump backtraces
- coredump_disable_storageDisable storing core dump
- kernel_module_tipc_disabledDisable TIPC Support
- package_chrony_installedThe Chrony package is installed
- package_nss-tools_installedEnsure nss-tools is installed

- FTA_TAB.1

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- FTP_ITC_EXT.1

- kerberos_disable_no_keytabDisable Kerberos by removing host keytab
- package_openssh-server_installedInstall the OpenSSH Server Package
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- FTP_ITC_EXT.1.1

- package_rsyslog_installedEnsure rsyslog is Installed

- pcidss

- Req-10.1

- service_auditd_enabledEnable auditd Service

- Req-10.2.1

- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate

- Req-10.2.2

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- Req-10.2.3

- audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information

- Req-10.2.4

- audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification

- Req-10.2.5

- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- Req-10.2.5.b

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- Req-10.2.7

- audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)

- Req-10.4

- package_ntp_installedInstall the ntp service
- service_ntp_enabledEnable the NTP Daemon
- service_ntpd_enabledEnable the NTP Daemon

- Req-10.4.1

- ntpd_specify_remote_serverSpecify a Remote NTP Server

- Req-10.4.2.b

- audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
- audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
- audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
- audit_rules_time_stimeRecord Attempts to Alter Time Through stime
- audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File

- Req-10.4.3

- chronyd_specify_remote_serverA remote time server for Chrony is configured
- ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
- ntpd_specify_remote_serverSpecify a Remote NTP Server

- Req-10.5.1

- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions

- Req-10.5.2

- audit_rules_immutableMake the auditd Configuration Immutable
- rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
- rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
- rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions

- Req-10.5.3

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin

- Req-10.5.5

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
- audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment

- Req-10.7

- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
- auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
- ensure_logrotate_activatedEnsure Logrotate Runs Periodically

- Req-10.7.a

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space

- Req-11.4

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- Req-11.5

- aide_build_databaseBuild and Test AIDE Database
- package_aide_installedInstall AIDE

- Req-8.1.1

- account_unique_nameEnsure All Accounts on the System Have Unique Names

- Req-8.1.8

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- Req-8.2.1

- accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed

- Req-8.2.3

- no_empty_passwordsPrevent Login to Accounts With Empty Password

- Req-8.2.4

- accounts_maximum_age_login_defsSet Password Maximum Age

- Req-8.5.a

- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group

- Req-8.7.c

- file_groupowner_etc_groupVerify Group Who Owns group File
- file_groupowner_etc_passwdVerify Group Who Owns passwd File
- file_groupowner_etc_shadowVerify Group Who Owns shadow File
- file_owner_etc_groupVerify User Who Owns group File
- file_owner_etc_passwdVerify User Who Owns passwd File
- file_owner_etc_shadowVerify User Who Owns shadow File
- file_permissions_etc_groupVerify Permissions on group File
- file_permissions_etc_passwdVerify Permissions on passwd File
- file_permissions_etc_shadowVerify Permissions on shadow File

- srg

- SRG-OS-000004-GPOS-00004

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- SRG-OS-000023-GPOS-00006

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- SRG-OS-000024-GPOS-00007

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- SRG-OS-000027-GPOS-00008

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User

- SRG-OS-000032-GPOS-00013

- sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE

- SRG-OS-000033-GPOS-00014

- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
- sshd_rekey_limitForce frequent session key renegotiation

- SRG-OS-000037-GPOS-00015

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service

- SRG-OS-000038-GPOS-00016

- service_auditd_enabledEnable auditd Service

- SRG-OS-000039-GPOS-00017

- auditd_name_formatSet hostname as computer node name in audit logs
- service_auditd_enabledEnable auditd Service

- SRG-OS-000040-GPOS-00018

- service_auditd_enabledEnable auditd Service

- SRG-OS-000041-GPOS-00019

- service_auditd_enabledEnable auditd Service

- SRG-OS-000042-GPOS-00020

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- SRG-OS-000042-GPOS-00021

- service_auditd_enabledEnable auditd Service

- SRG-OS-000046-GPOS-00022

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account

- SRG-OS-000047-GPOS-00023

- auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
- auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
- auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size

- SRG-OS-000051-GPOS-00024

- auditd_freqSet number of records to cause an explicit flush to audit logs
- package_rsyslog_installedEnsure rsyslog is Installed
- service_auditd_enabledEnable auditd Service

- SRG-OS-000054-GPOS-00025

- service_auditd_enabledEnable auditd Service

- SRG-OS-000057-GPOS-00027

- audit_rules_immutableMake the auditd Configuration Immutable
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

- SRG-OS-000058-GPOS-00028

- audit_rules_immutableMake the auditd Configuration Immutable
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

- SRG-OS-000059-GPOS-00029

- audit_rules_immutableMake the auditd Configuration Immutable
- directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root

- SRG-OS-000062-GPOS-00031

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- auditd_local_eventsInclude Local Events in Audit Logs
- package_audit_installedEnsure the audit Subsystem is Installed
- service_auditd_enabledEnable auditd Service

- SRG-OS-000063-GPOS-00032

- file_groupownership_audit_configurationAudit Configuration Files Must Be Owned By Group root
- file_ownership_audit_configurationAudit Configuration Files Must Be Owned By Root

- SRG-OS-000064-GPOS-00033

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate

- SRG-OS-000074-GPOS-00042

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- SRG-OS-000075-GPOS-00043

- accounts_minimum_age_login_defsSet Password Minimum Age

- SRG-OS-000076-GPOS-00044

- accounts_maximum_age_login_defsSet Password Maximum Age

- SRG-OS-000078-GPOS-00046

- accounts_password_minlen_login_defsSet Password Minimum Length in login.defs

- SRG-OS-000095-GPOS-00049

- kernel_module_tipc_disabledDisable TIPC Support

- SRG-OS-000104-GPOS-00051

- gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group

- SRG-OS-000105-GPOS-00052

- sshd_enable_pubkey_authEnable Public Key Authentication

- SRG-OS-000106-GPOS-00053

- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_enable_pubkey_authEnable Public Key Authentication

- SRG-OS-000107-GPOS-00054

- sshd_enable_pubkey_authEnable Public Key Authentication

- SRG-OS-000108-GPOS-00055

- sshd_enable_pubkey_authEnable Public Key Authentication

- SRG-OS-000109-GPOS-00056

- sshd_disable_root_loginDisable SSH Root Login

- SRG-OS-000120-GPOS-00061

- kerberos_disable_no_keytabDisable Kerberos by removing host keytab

- SRG-OS-000122-GPOS-00063

- package_audit_installedEnsure the audit Subsystem is Installed
- service_auditd_enabledEnable auditd Service

- SRG-OS-000125-GPOS-00065

- sshd_enable_pamEnable PAM

- SRG-OS-000126-GPOS-00066

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval

- SRG-OS-000132-GPOS-00067

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access

- SRG-OS-000138-GPOS-00069

- dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set

- SRG-OS-000163-GPOS-00072

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- SRG-OS-000191-GPOS-00080

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- SRG-OS-000196

- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module

- SRG-OS-000206-GPOS-00084

- file_groupowner_var_logVerify Group Who Owns /var/log Directory
- file_groupowner_var_log_messagesVerify Group Who Owns /var/log/messages File
- file_groupowner_var_log_syslogVerify Group Who Owns /var/log/syslog File
- file_owner_var_logVerify User Who Owns /var/log Directory
- file_owner_var_log_messagesVerify User Who Owns /var/log/messages File
- file_owner_var_log_syslogVerify User Who Owns /var/log/syslog File
- file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
- file_permissions_var_logVerify Permissions on /var/log Directory
- file_permissions_var_log_messagesVerify Permissions on /var/log/messages File
- file_permissions_var_log_syslogVerify Permissions on /var/log/syslog File

- SRG-OS-000228-GPOS-00088

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- SRG-OS-000239-GPOS-00089

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- SRG-OS-000240-GPOS-00090

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- SRG-OS-000241-GPOS-00090

- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- SRG-OS-000241-GPOS-00091

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- SRG-OS-000250-GPOS-00093

- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy

- SRG-OS-000254-GPOS-00095

- service_auditd_enabledEnable auditd Service

- SRG-OS-000255-GPOS-00096

- auditd_log_formatResolve information before writing to audit logs
- service_auditd_enabledEnable auditd Service

- SRG-OS-000258-GPOS-00099

- dir_ownership_binary_dirsVerify that System Executable Have Root Ownership
- dir_permissions_binary_dirsVerify that System Executable Directories Have Restrictive Permissions

- SRG-OS-000259-GPOS-00100

- dir_ownership_library_dirsVerify that Shared Library Directories Have Root Ownership
- dir_permissions_library_dirsVerify that Shared Library Directories Have Restrictive Permissions
- file_ownership_binary_dirsVerify that System Executables Have Root Ownership
- file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
- file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
- file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions

- SRG-OS-000279-GPOS-00109

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- SRG-OS-000303-GPOS-00120

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- SRG-OS-000304-GPOS-00121

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- SRG-OS-000324-GPOS-00125

- securetty_root_login_console_onlyRestrict Virtual Console Root Logins
- sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
- sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks

- SRG-OS-000327-GPOS-00127

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands

- SRG-OS-000337-GPOS-00129

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000341-GPOS-00132

- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

- SRG-OS-000342-GPOS-00133

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_name_formatSet hostname as computer node name in audit logs
- auditd_overflow_actionAppropriate Action Must be Setup When the Internal Audit Event Queue is Full
- package_audit-audispd-plugins_installedEnsure the default plugins for the audit dispatcher are Installed
- rsyslog_encrypt_offload_actionsendstreamdriverauthmodeEnsure Rsyslog Authenticates Off-Loaded Audit Records
- rsyslog_encrypt_offload_actionsendstreamdrivermodeEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_encrypt_offload_defaultnetstreamdriverEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- SRG-OS-000343-GPOS-00134

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space

- SRG-OS-000348-GPOS-00136

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000349-GPOS-00137

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000350-GPOS-00138

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000351-GPOS-00139

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000352-GPOS-00140

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000353-GPOS-00141

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000354-GPOS-00142

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000355-GPOS-00143

- chronyd_server_directiveEnsure Chrony is only configured with the server directive
- package_chrony_installedThe Chrony package is installed

- SRG-OS-000356-GPOS-00144

- chronyd_server_directiveEnsure Chrony is only configured with the server directive

- SRG-OS-000358-GPOS-00145

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000359-GPOS-00146

- chronyd_server_directiveEnsure Chrony is only configured with the server directive
- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000363-GPOS-00150

- package_aide_installedInstall AIDE

- SRG-OS-000364-GPOS-00151

- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication

- SRG-OS-000365-GPOS-00152

- package_audit_installedEnsure the audit Subsystem is Installed
- service_auditd_enabledEnable auditd Service

- SRG-OS-000368-GPOS-00154

- mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
- mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm

- SRG-OS-000373-GPOS-00156

- disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
- sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo

- SRG-OS-000373-GPOS-00157

- disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- SRG-OS-000373-GPOS-00158

- disallow_bypass_password_sudoDisallow Configuration to Bypass Password Requirements for Privilege Escalation
- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- SRG-OS-000392-GPOS-00172

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
- service_auditd_enabledEnable auditd Service

- SRG-OS-000393-GPOS-00173

- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy

- SRG-OS-000394-GPOS-00174

- harden_ssh_client_crypto_policyHarden SSH client Crypto Policy

- SRG-OS-000395-GPOS-00175

- sshd_set_idle_timeoutSet SSH Idle Timeout Interval

- SRG-OS-000423-GPOS-00187

- package_openssh-server_installedInstall the OpenSSH Server Package

- SRG-OS-000424-GPOS-00188

- package_openssh-server_installedInstall the OpenSSH Server Package

- SRG-OS-000425-GPOS-00189

- package_openssh-server_installedInstall the OpenSSH Server Package

- SRG-OS-000426-GPOS-00190

- package_openssh-server_installedInstall the OpenSSH Server Package

- SRG-OS-000433-GPOS-00192

- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access

- SRG-OS-000433-GPOS-00193

- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- SRG-OS-000445-GPOS-00199

- package_aide_installedInstall AIDE
- selinux_stateEnsure SELinux State is Enforcing

- SRG-OS-000458-GPOS-00203

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate

- SRG-OS-000461-GPOS-00205

- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate

- SRG-OS-000462-GPOS-00206

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- SRG-OS-000463-GPOS-00207

- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr

- SRG-OS-000466-GPOS-00210

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- SRG-OS-000467-GPOS-00211

- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

- SRG-OS-000468-GPOS-00212

- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

- SRG-OS-000470-GPOS-00214

- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- SRG-OS-000471-GPOS-00215

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_dac_modification_umountRecord Events that Modify the System's Discretionary Access Controls - umount
- audit_rules_dac_modification_umount2Record Events that Modify the System's Discretionary Access Controls - umount2
- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- SRG-OS-000471-GPOS-00216

- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module

- SRG-OS-000473-GPOS-00218

- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog

- SRG-OS-000474-GPOS-00219

- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000475-GPOS-00220

- package_audit_installedEnsure the audit Subsystem is Installed

- SRG-OS-000476-GPOS-00221

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
- audit_rules_usergroup_modificationRecord Events that Modify User/Group Information

- SRG-OS-000477-GPOS-00222

- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module

- SRG-OS-000479-GPOS-00224

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
- auditd_name_formatSet hostname as computer node name in audit logs
- auditd_overflow_actionAppropriate Action Must be Setup When the Internal Audit Event Queue is Full
- package_rsyslog_installedEnsure rsyslog is Installed
- rsyslog_encrypt_offload_actionsendstreamdriverauthmodeEnsure Rsyslog Authenticates Off-Loaded Audit Records
- rsyslog_encrypt_offload_actionsendstreamdrivermodeEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_encrypt_offload_defaultnetstreamdriverEnsure Rsyslog Encrypts Off-Loaded Audit Records
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- SRG-OS-000480-GPOS-00226

- accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs

- SRG-OS-000480-GPOS-00227

- accounts_no_uid_except_zeroVerify Only Root Has UID 0
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
- auditd_local_eventsInclude Local Events in Audit Logs
- auditd_log_formatResolve information before writing to audit logs
- auditd_write_logsWrite Audit Logs to the Disk
- coredump_disable_backtracesDisable core dump backtraces
- coredump_disable_storageDisable storing core dump
- display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
- file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
- file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
- no_empty_passwordsPrevent Login to Accounts With Empty Password
- no_empty_passwords_etc_shadowEnsure There Are No Accounts With Blank or Null Passwords
- package_MFEhiplsm_installedInstall the Host Intrusion Prevention System (HIPS) Module
- package_audit_installedEnsure the audit Subsystem is Installed
- package_gnutls-utils_installedEnsure gnutls-utils is installed
- package_nss-tools_installedEnsure nss-tools is installed
- package_rsyslog_installedEnsure rsyslog is Installed
- partition_for_homeEnsure /home Located On Separate Partition
- partition_for_tmpEnsure /tmp Located On Separate Partition
- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_logEnsure /var/log Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
- rsyslog_remote_loghostEnsure Logs Sent To Remote Host
- service_auditd_enabledEnable auditd Service
- service_rsyslog_enabledEnable rsyslog Service
- snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
- sshd_allow_only_protocol2Allow Only SSH Protocol 2
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_rhostsDisable SSH Support for .rhosts Files
- sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
- sshd_disable_x11_forwardingDisable X11 Forwarding
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
- sshd_print_last_logEnable SSH Print Last Log
- sshd_rekey_limitForce frequent session key renegotiation
- sshd_use_priv_separationEnable Use of Privilege Separation
- sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
- sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space

- SRG-OS-000480-GPOS-00228

- accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
- accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile

- SRG-OS-000480-GPOS-00229

- disable_host_authDisable Host-Based Authentication
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options

- vmmsrg

- SRG-OS-000023-VMM-000060

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- SRG-OS-000024-VMM-000070

- sshd_enable_warning_bannerEnable SSH Warning Banner
- sshd_enable_warning_banner_netEnable SSH Warning Banner

- SRG-OS-000027-VMM-000080

- accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User

- SRG-OS-000032-VMM-000130

- rsyslog_remote_loghostEnsure Logs Sent To Remote Host

- SRG-OS-000033-VMM-000140

- sshd_allow_only_protocol2Allow Only SSH Protocol 2

- SRG-OS-000037-VMM-000150

- service_auditd_enabledEnable auditd Service

- SRG-OS-000038-VMM-000160

- service_auditd_enabledEnable auditd Service

- SRG-OS-000039-VMM-000170

- service_auditd_enabledEnable auditd Service

- SRG-OS-000040-VMM-000180

- service_auditd_enabledEnable auditd Service

- SRG-OS-000041-VMM-000190

- service_auditd_enabledEnable auditd Service

- SRG-OS-000046-VMM-000210

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space

- SRG-OS-000051-VMM-000230

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin

- SRG-OS-000058-VMM-000270

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin

- SRG-OS-000059-VMM-000280

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin

- SRG-OS-000063-VMM-000310

- service_auditd_enabledEnable auditd Service

- SRG-OS-000107-VMM-000530

- sshd_disable_rhostsDisable SSH Support for .rhosts Files

- SRG-OS-000341-VMM-001220

- partition_for_varEnsure /var Located On Separate Partition
- partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition

- SRG-OS-000343-VMM-001240

- auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
- auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space

- SRG-OS-000458-VMM-001810

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate

- SRG-OS-000461-VMM-001830

- audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
- audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
- audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
- audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
- audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
- audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate

- SRG-OS-000462-VMM-001840

- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- SRG-OS-000466-VMM-001870

- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

- SRG-OS-000468-VMM-001890

- audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
- audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
- audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
- audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
- audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat

- SRG-OS-000470-VMM-001900

- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog

- SRG-OS-000471-VMM-001910

- audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
- audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions

- SRG-OS-000473-VMM-001930

- audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
- audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
- audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog

- SRG-OS-000474-VMM-001940

- audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
- audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
- audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
- audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
- audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
- audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
- audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
- audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
- audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
- audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
- audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
- audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
- audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr

- SRG-OS-000477-VMM-001970

- audit_rules_kernel_module_loading_deleteEnsure auditd Collects Information on Kernel Module Unloading - delete_module
- audit_rules_kernel_module_loading_finitEnsure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
- audit_rules_kernel_module_loading_initEnsure auditd Collects Information on Kernel Module Loading - init_module

- SRG-OS-000479-VMM-001990

- auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin

- SRG-OS-000480-VMM-002000

- disable_host_authDisable Host-Based Authentication
- service_snmpd_disabledDisable snmpd Service
- sshd_disable_compressionDisable Compression Or Set Compression to delayed
- sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
- sshd_disable_gssapi_authDisable GSSAPI Authentication
- sshd_disable_kerb_authDisable Kerberos Authentication
- sshd_disable_root_loginDisable SSH Root Login
- sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
- sshd_enable_strictmodesEnable Use of Strict Mode Checking
- sshd_set_idle_timeoutSet SSH Idle Timeout Interval
- sshd_set_keepaliveSet SSH Client Alive Count Max
- sshd_set_keepalive_0Set SSH Client Alive Count Max to zero

- vsrg

- SRG-OS-000373-VMM-001470

- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- SRG-OS-000373-VMM-001480

- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- SRG-OS-000373-VMM-001490

- sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
- sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

- SRG-OS-000445-VMM-001780

- selinux_stateEnsure SELinux State is Enforcing