[DRAFT] Protection Profile for General Purpose Operating Systems

Mapping | CCE | Rule Title | Description | Rationale | Variable Setting
AU-2(a) | N/A | Configure auditing of unsuccessful file accesses | Ensure that unsuccessful attempts to access a file are audited. The following rules configure audit as described above:
    ## Unsuccessful file access (any other opens) This has to go last.
    -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
    -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
    -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
    -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. | Unsuccessful attempts to access a file might be signs of malicious activity happening within the system. Auditing of such activities helps in their monitoring and investigation. |
AU-2(a) | N/A | Configure auditing of successful file accesses | Ensure that successful attempts to access a file are audited. The following rules configure audit as described above:
    ## Successful file access (any other opens) This has to go last.
    ## These next two are likely to result in a whole lot of events
    -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
    -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-3-access-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-3-access-success.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. | Auditing of successful attempts to access a file helps in investigation of activities performed on the system. |
AU-2(a) | N/A | Configure basic parameters of Audit system | Perform basic configuration of Audit system. Make sure that any previously defined rules are cleared, the auditing system is configured to handle sudden bursts of events, and in cases of failure, messages are configured to be directed to system log. The following rules configure audit as described above:
    ## First rule - delete all
    -D

    ## Increase the buffers to survive stress events.
    ## Make this bigger for busy systems
    -b 8192

    ## This determine how long to wait in burst of events
    --backlog_wait_time 60000

    ## Set failure mode to syslog
    -f 1
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/10-base-config.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/10-base-config.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
| Without basic configurations, audit may not perform as expected. It may not be able to correctly handle events under stressful conditions, or log events in case of failure. |
AU-2(a) | N/A | Configure auditing of unsuccessful file creations | Ensure that unsuccessful attempts to create a file are audited. The following rules configure audit as described above:
    ## Unsuccessful file creation (open with O_CREAT)
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
    -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-1-create-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-1-create-failed.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. | Unsuccessful file creations might be a sign of a malicious action being performed on the system. Keeping log of such events helps in monitoring and investigation of such actions. |
AU-2(a) | N/A | Configure auditing of successful file creations | Ensure that successful attempts to create a file are audited. The following rules configure audit as described above:
    ## Successful file creation (open with O_CREAT)
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
    -a always,exit -F arch=b32 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
    -a always,exit -F arch=b64 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
    -a always,exit -F arch=b32 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
    -a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-1-create-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-1-create-success.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
| Auditing of successful attempts to create a file helps in investigation of actions which happened on the system. |
AU-2(a) | N/A | Configure auditing of unsuccessful file deletions | Ensure that unsuccessful attempts to delete a file are audited. The following rules configure audit as described above:
    ## Unsuccessful file delete
    -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-4-delete-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-4-delete-failed.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. | Unsuccessful attempts to delete a file might be signs of malicious activities. Auditing of such events help in monitoring and investigating of such activities. |
AU-2(a) | N/A | Configure auditing of successful file deletions | Ensure that successful attempts to delete a file are audited. The following rules configure audit as described above:
    ## Successful file delete
    -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
    -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-4-delete-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-4-delete-success.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. | Auditing of successful attempts to delete a file may help in monitoring and investigation of activities performed on the system. |
AU-2(a) | N/A | Configure immutable Audit login UIDs | Configure kernel to prevent modification of login UIDs once they are set. Changing login UIDs while this configuration is enforced requires special capabilities which are not available to unprivileged users. The following rules configure audit as described above:
    ## Make the loginuid immutable. This prevents tampering with the auid.
    --loginuid-immutable
The `Audit` provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/11-loginuid.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/11-loginuid.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
| If modification of login UIDs is not prevented, they can be changed by unprivileged users and make auditing complicated or impossible. |
AU-2(a) | N/A | Configure auditing of unsuccessful file modifications | Ensure that unsuccessful attempts to modify a file are audited. The following rules configure audit as described above:
    ## Unsuccessful file modifications (open for write or truncate)
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
    -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-2-modify-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-2-modify-failed.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. | Unsuccessful file modifications might be a sign of a malicious action being performed on the system. Auditing of such events helps in detection and investigation of such actions. |
AU-2(a) | N/A | Configure auditing of successful file modifications | Ensure that successful attempts to modify a file are audited. The following rules configure audit as described above:
    ## Successful file modifications (open for write or truncate)
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
    -a always,exit -F arch=b32 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
    -a always,exit -F arch=b64 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
    -a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
    -a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-2-modify-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-2-modify-success.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. | Auditing of successful attempts to modify a file helps in investigation of actions which happened on the system. |
AU-2(a) | N/A | Configure auditing of loading and unloading of kernel modules | Ensure that loading and unloading of kernel modules is audited. The following rules configure audit as described above:
    ## These rules watch for kernel module insertion. By monitoring
    ## the syscall, we do not need any watches on programs.
    -a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load
    -a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load
    -a always,exit -F arch=b32 -S delete_module -F key=module-unload
    -a always,exit -F arch=b64 -S delete_module -F key=module-unload
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/43-module-load.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/43-module-load.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
| Loading of a malicious kernel module introduces a risk to the system, as the module has access to sensitive data and perform actions at the operating system kernel level. Having such events audited helps in monitoring and investigating of malicious activities. |
AU-2(a) | N/A | Perform general configuration of Audit for OSPP | Configure some basic `Audit` parameters specific for OSPP profile. In particular, configure `Audit` to watch for direct modification of files storing system user and group information, and usage of applications with special rights which can change system configuration. Further audited events include access to audit log it self, attempts to Alter Process and Session Initiation Information, and attempts to modify MAC controls. The following rules configure audit as described above:
    ## The purpose of these rules is to meet the requirements for Operating
    ## System Protection Profile (OSPP)v4.2. These rules depends on having
    ## the following rule files copied to /etc/audit/rules.d:
    ##
    ## 10-base-config.rules, 11-loginuid.rules,
    ## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules,
    ## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules,
    ## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules,
    ## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules,
    ## 30-ospp-v42-5-perm-change-failed.rules,
    ## 30-ospp-v42-5-perm-change-success.rules,
    ## 30-ospp-v42-6-owner-change-failed.rules,
    ## 30-ospp-v42-6-owner-change-success.rules
    ##
    ## original copies may be found in /usr/share/audit/sample-rules/

    ## User add delete modify. This is covered by pam. However, someone could
    ## open a file and directly create or modify a user, so we'll watch passwd and
    ## shadow for writes
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify

    ## User enable and disable. This is entirely handled by pam.

    ## Group add delete modify. This is covered by pam. However, someone could
    ## open a file and directly create or modify a user, so we'll watch group and
    ## gshadow for writes
    -a always,exit -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify
    -a always,exit -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify
    -a always,exit -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify

    ## Use of special rights for config changes. This would be use of setuid
    ## programs that relate to user accts. This is not all setuid apps because
    ## requirements are only for ones that affect system configuration.
    -a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes
    -a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes

    ## Privilege escalation via su or sudo. This is entirely handled by pam.

    ## Watch for configuration changes to privilege escalation.
    -a always,exit -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
    -a always,exit -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes

    ## Audit log access
    -a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail
    ## Attempts to Alter Process and Session Initiation Information
    -a always,exit -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session
    -a always,exit -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session
    -a always,exit -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session

    ## Attempts to modify MAC controls
    -a always,exit -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy

    ## Software updates. This is entirely handled by rpm.

    ## System start and shutdown. This is entirely handled by systemd

    ## Kernel Module loading. This is handled in 43-module-load.rules

    ## Application invocation. The requirements list an optional requirement
    ## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to
    ## state results from that policy. This would be handled entirely by
    ## that daemon.
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. | Auditing of events listed in the description provides data for monitoring and investigation of potentially malicious events e.g. tampering with `Audit` logs, malicious access to files storing information about system users and groups etc. |
AU-2(a) | N/A | Configure auditing of unsuccessful ownership changes | Ensure that unsuccessful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above:
    ## Unsuccessful ownership change
    -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change
    -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change
    -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change
    -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-failed.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. | Unsuccessful attempts to change an ownership of files or directories might be signs of a malicious activity. Having such events audited helps in monitoring and investigation of such activities. |
AU-2(a) | N/A | Configure auditing of successful ownership changes | Ensure that successful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above:
    ## Successful ownership change
    -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change
    -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-success.rules /etc/audit/rules.d/
The file has the following SHA-256 checksum:
    7eb41a6aaf6737c2571b6424fae7fa53af4b41a9115b6c5732a5778ccd9900ad
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. | Auditing of successful ownership changes of files or directories helps in monitoring or investingating of activities performed on the system. |
AU-2(a) | N/A | Configure auditing of unsuccessful permission changes | Ensure that unsuccessful attempts to change file or directory permissions are audited. The following rules configure audit as described above:
    ## Unsuccessful permission change
    -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change
    -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change
    -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change
    -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-failed.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-failed.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. | Unsuccessful attempts to change permissions of files or directories might be signs of malicious activity. Having such events audited helps in monitoring and investigation of such activities. |
AU-2(a) | N/A | Configure auditing of successful permission changes | Ensure that successful attempts to modify permissions of files or directories are audited. The following rules configure audit as described above:
    ## Successful permission change
    -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
    -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change
The `Audit` package provides pre-configured rules in `/usr/share/audit/sample-rules`. The above content can be found in `/usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-success.rules`. To deploy this configuration, it is recommended to copy it over to the `/etc/audit/rules.d/` directory:
    cp /usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-success.rules /etc/audit/rules.d/
Load new Audit rules into kernel by running:
    augenrules --load
Note: This rule utilizes a file provided by `Audit` package to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. | Auditing successful file or directory permission changes helps in monitoring and investigating of activities performed on the system. |
AU-2 CM-8(3) IA-3 | N/A | Log USBGuard daemon audit events using Linux Audit | To configure USBGuard daemon to log via Linux Audit (as opposed directly to a file), `AuditBackend` option in `/etc/usbguard/usbguard-daemon.conf` needs to be set to `LinuxAudit`. | Using the Linux Audit logging allows for centralized trace of events. |
IA-2 AC-3 CM-6(a) | N/A | Require Authentication for Single User Mode | Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. By default, no authentication is performed if single-user mode is selected. By default, single-user mode is protected by requiring a password and is set in `/usr/lib/systemd/system/rescue.service`. | This prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password. |
AC-2(g) AU-3 AU-10 AU-2(d) AU-12(c) AU-14(1) AC-6(9) CM-6(a) SI-4(23) | N/A | Enable auditd Service | The `auditd` service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The `auditd` service can be enabled with the following command:
    $ sudo systemctl enable auditd.service
| Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Ensuring the `auditd` service is active ensures audit records generated by the kernel are appropriately recorded. Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions. |
SC-2(1) CM-6(a) | N/A | Verify that Interactive Boot is Disabled | Oracle Linux 8 systems support an "interactive boot" option that can be used to prevent services from being started. On a Oracle Linux 8 system, interactive boot can be enabled by providing a `1`, `yes`, `true`, or `on` value to the `systemd.confirm_spawn` kernel argument in `/etc/default/grub`. Remove any instance of
    systemd.confirm_spawn=(1|yes|true|on)
from the kernel arguments in that file to disable interactive boot. It is also required to change the runtime configuration, run:
    /sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"
| Using interactive boot, the console user could disable auditing, firewalls, or other services, weakening system security. |
SI-2(5) CM-6(a) SI-2(c) | N/A | Configure dnf-automatic to Install Available Updates Automatically | To ensure that the packages comprising the available updates will be automatically installed by `dnf-automatic`, set `apply_updates` to `yes` under `[commands]` section in `/etc/dnf/automatic.conf`. | Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities. If the most recent security patches and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The lack of prompt attention to patching could result in a system compromise. The automated installation of updates ensures that recent security patches are applied in a timely manner. |
SI-2(5) CM-6(a) SI-2(c) | N/A | Configure dnf-automatic to Install Only Security Updates | To configure `dnf-automatic` to install only security updates automatically, set `upgrade_type` to `security` under `[commands]` section in `/etc/dnf/automatic.conf`. | By default, `dnf-automatic` installs all available updates. Reducing the amount of updated packages only to updates that were issued as a part of a security advisory increases the system stability. |
AC-2(5) AC-12 AC-17(a) SC-10 CM-6(a) | N/A | Set SSH Client Alive Count Max to zero | The SSH server sends at most `ClientAliveCountMax` messages during a SSH session and waits for a response from the SSH client. The option `ClientAliveInterval` configures timeout after each `ClientAliveCountMax` message. If the SSH server does not receive a response from the client, then the connection is considered idle and terminated. To ensure the SSH idle timeout occurs precisely when the `ClientAliveInterval` is set, set the `ClientAliveCountMax` to value of `0` in `/etc/ssh/sshd_config`: | This ensures a user login will be terminated as soon as the `ClientAliveInterval` is reached. |
SI-2(5) CM-6(a) SI-2(c) | N/A | Enable dnf-automatic Timer | The `dnf-automatic` timer can be enabled with the following command:
    $ sudo systemctl enable dnf-automatic.timer
| The `dnf-automatic` is an alternative command line interface (CLI) to `dnf upgrade` with specific facilities to make it suitable to be executed automatically and regularly from systemd timers, cron jobs and similar. The tool is controlled by `dnf-automatic.timer` SystemD timer. |
AC-3 AC-17(a) CM-7(a) CM-7(b) CM-6(a) | N/A | Disable Host-Based Authentication | SSH's cryptographic host-based authentication is more secure than `.rhosts` authentication. However, it is not recommended that hosts unilaterally trust one another, even within an organization. The default SSH configuration disables host-based authentication. The appropriate configuration is used if no value is set for `HostbasedAuthentication`. To explicitly disable host-based authentication, add or correct the following line in `/etc/ssh/sshd_config`:
    HostbasedAuthentication no
| SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. |
AC-3 AC-3(3)(a) AU-9 SC-7(21) | N/A | Configure SELinux Policy | The SELinux `targeted` policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct the following line in `/etc/selinux/config`:
    SELINUXTYPE=targeted
Other policies, such as `mls`, provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases. | Setting the SELinux policy to `targeted` or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. Note: During the development or debugging of SELinux modules, it is common to temporarily place non-production systems in `permissive` mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to ``. | var_selinux_policy_name=targeted
AC-3 AC-3(3)(a) AU-9 SC-7(21) | N/A | Ensure SELinux State is Enforcing | The SELinux state should be set to ``enforcing`` at system boot time. In the file `/etc/selinux/config`, add or correct the following line to configure the system to boot into enforcing mode:
    SELINUX=enforcing
| Setting the SELinux state to enforcing ensures SELinux is able to confine potentially compromised processes to the security policy, which is designed to prevent them from causing damage to the system or further elevating their privileges. | var_selinux_state=enforcing
AC-4 CM-7(b) CA-3(5) SC-7(21) CM-6(a) | N/A | Verify firewalld Enabled | The `firewalld` service can be enabled with the following command:
    $ sudo systemctl enable firewalld.service
| Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols. |
IA-5(f) IA-5(1)(a) CM-6(a) | N/A | Set Password Minimum Length in login.defs | To specify password length requirements for new accounts, edit the file `/etc/login.defs` and add or correct the following line:
    PASS_MIN_LEN 12
The DoD requirement is `15`. The FISMA requirement is `12`. The profile requirement is ``12``. If a program consults `/etc/login.defs` and also another PAM module (such as `pam_pwquality`) during a password change operation, then the most restrictive must be satisfied. See PAM section for more information about enforcing password quality requirements. | Requiring a minimum password length makes password cracking attacks more difficult by ensuring a larger search space. However, any security benefit from an onerous requirement must be carefully weighed against usability problems, support costs, or counterproductive behavior that may result. | var_accounts_password_minlen_login_defs=12
IA-5(c) IA-5(1)(a) CM-6(a) IA-5(4) | N/A | Ensure PAM Enforces Password Requirements - Minimum Digit Characters | The pam_pwquality module's `dcredit` parameter controls requirements for usage of digits in a password. When set to a negative number, any password will be required to contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional length credit for each digit. Modify the `dcredit` setting in `/etc/security/pwquality.conf` to require the use of a digit in passwords. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring digits makes password guessing attacks more difficult by ensuring a larger search space. |
IA-5(c) IA-5(1)(b) CM-6(a) IA-5(4) | N/A | Ensure PAM Enforces Password Requirements - Minimum Different Characters | The pam_pwquality module's `difok` parameter sets the number of characters in a password that must not be present in and old password during a password change. Modify the `difok` setting in `/etc/security/pwquality.conf` to equal `4` to require differing characters when changing passwords. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute–force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note that passwords which are changed on compromised systems will still be compromised, however. | var_password_pam_difok=4
IA-5(c) IA-5(1)(a) CM-6(a) IA-5(4) | N/A | Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters | The pam_pwquality module's `lcredit` parameter controls requirements for usage of lowercase letters in a password. When set to a negative number, any password will be required to contain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each lowercase character. Modify the `lcredit` setting in `/etc/security/pwquality.conf` to require the use of a lowercase character in passwords. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possble combinations that need to be tested before the password is compromised. Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space. |
IA-5(c) IA-5(1)(a) CM-6(a) IA-5(4) | N/A | Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class | The pam_pwquality module's `maxclassrepeat` parameter controls requirements for consecutive repeating characters from the same character class. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters from the same character class. Modify the `maxclassrepeat` setting in `/etc/security/pwquality.conf` to equal `4` to prevent a run of (`4` + 1) or more identical characters. | Use of a complex password helps to increase the time and resources required to comrpomise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that need to be tested before the password is compromised. | var_password_pam_maxclassrepeat=4
IA-5(c) CM-6(a) IA-5(4) | N/A | Set Password Maximum Consecutive Repeating Characters | The pam_pwquality module's `maxrepeat` parameter controls requirements for consecutive repeating characters. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters. Modify the `maxrepeat` setting in `/etc/security/pwquality.conf` to equal `3` to prevent a run of (`3` + 1) or more identical characters. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks. | var_password_pam_maxrepeat=3
IA-5(c) IA-5(1)(a) CM-6(a) IA-5(4) | N/A | Ensure PAM Enforces Password Requirements - Minimum Length | The pam_pwquality module's `minlen` parameter controls requirements for minimum characters required in a password. Add `minlen=`12`` after pam_pwquality to set minimum password length requirements. | The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromose the password. | var_password_pam_minlen=12
IA-5(c) IA-5(1)(a) CM-6(a) IA-5(4) | N/A | Ensure PAM Enforces Password Requirements - Minimum Special Characters | The pam_pwquality module's `ocredit=` parameter controls requirements for usage of special (or "other") characters in a password. When set to a negative number, any password will be required to contain that many special characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each special character. Modify the `ocredit` setting in `/etc/security/pwquality.conf` to equal `1` to require use of a special character in passwords. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possble combinations that need to be tested before the password is compromised. Requiring a minimum number of special characters makes password guessing attacks more difficult by ensuring a larger search space. | var_password_pam_ocredit=1
IA-5(c) IA-5(1)(a) CM-6(a) IA-5(4) | N/A | Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters | The pam_pwquality module's `ucredit=` parameter controls requirements for usage of uppercase letters in a password. When set to a negative number, any password will be required to contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each uppercase character. Modify the `ucredit` setting in `/etc/security/pwquality.conf` to require the use of an uppercase character in passwords. | Use of a complex password helps to increase the time and resources reuiqred to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. |
- IA-5(f) IA-5(1)(e) | N/A | Limit Password Reuse | Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_unix` or `pam_pwhistory` PAM modules. In the file `/etc/pam.d/system-auth`, append `remember=`5`` to the line which refers to the `pam_unix.so` or `pam_pwhistory.so`module, as shown below: for the `pam_unix.so` case:
      password sufficient pam_unix.so ...existing_options... remember=5
- for the `pam_pwhistory.so` case:
      password requisite pam_pwhistory.so ...existing_options... remember=5
The DoD STIG requirement is 5 passwords. | Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user. | var_password_pam_unix_remember=5
IA-5(1)(a) IA-5(c) CM-6(a) | N/A | Prevent Login to Accounts With Empty Password | If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. Remove any instances of the `nullok` in `/etc/pam.d/system-auth` to prevent logins with empty passwords. | If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments. |
CM-5(3) SI-7 SC-12 SC-12(3) CM-6(a) SA-12 SA-12(10) CM-11(a) CM-11(b) | N/A | Ensure gpgcheck Enabled In Main yum Configuration | The `gpgcheck` option controls whether RPM packages' signatures are always checked prior to installation. To configure yum to check package signatures before installing them, ensure the following line appears in `/etc/yum.conf` in the `[main]` section:
    gpgcheck=1
| Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA). |
CM-5(3) SI-7 SC-12 SC-12(3) CM-6(a) SA-12 SA-12(10) CM-11(a) CM-11(b) | N/A | Ensure gpgcheck Enabled for All yum Package Repositories | To ensure signature checking is not disabled for any repos, remove any lines from files in `/etc/yum.repos.d` of the form:
    gpgcheck=0
| Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA)." |
CM-5(3) SI-7 SC-12 SC-12(3) CM-6(a) CM-11(a) CM-11(b) | N/A | Ensure Oracle Linux GPG Key Installed | To ensure the system can cryptographically verify base software packages come from Oracle (and to connect to the Unbreakable Linux Network to receive them), the Oracle GPG key must properly be installed. To install the Oracle GPG key, run:
    $ sudo uln_register
If the system is not connected to the Internet, then install the Oracle GPG key from trusted media such as the Oracle installation CD-ROM or DVD. Assuming the disc is mounted in `/media/cdrom`, use the following command as the root user to import it into the keyring:
    $ sudo rpm --import /media/cdrom/RPM-GPG-KEY-oracle
Alternatively, the key may be pre-loaded during the Oracle installation. In such cases, the key can be installed by running the following command:
    sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
| Changes to software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. The Oracle GPG key is necessary to cryptographically verify packages are from Oracle. |
CM-6(a) AC-7(a) | N/A | Lock Accounts After Failed Password Attempts | This rule configures the system to lock out accounts after a number of incorrect login attempts using `pam_faillock.so`. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid any errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version. | Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. In combination with the `silent` option, user enumeration attacks are also mitigated. |
- CM-6(a) AC-7(a) | N/A | Set Interval For Counting Failed Password Attempts | Utilizing `pam_faillock.so`, the `fail_interval` directive configures the system to lock out an account after a number of incorrect login attempts within a specified time period. First make sure the feature is enabled using the following command:
      authselect enable-feature with-faillock
- Then edit the `/etc/security/faillock.conf` file as follows: add, uncomment or edit the following line:
      fail_interval = 900
- add or uncomment the following line:
      silent
| By limiting the number of failed logon attempts the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account. | var_accounts_passwords_pam_faillock_fail_interval=900
CM-6(a) AC-7(b) | N/A | Set Lockout Time for Failed Password Attempts | This rule configures the system to lock out accounts during a specified time period after a number of incorrect login attempts using `pam_faillock.so`. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid any errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version. | Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. Ensuring that an administrator is involved in unlocking locked accounts draws appropriate attention to such situations. |
CM-6 | N/A | Set number of records to cause an explicit flush to audit logs | To configure Audit daemon to issue an explicit flush to disk command after writing 50 records, set `freq` to `50` in `/etc/audit/auditd.conf`. | If option `freq` isn't set to `50`, the flush to disk may happen after higher number of records, increasing the danger of audit loss. |
CM-6 | N/A | Include Local Events in Audit Logs | To configure Audit daemon to include local events in Audit logs, set `local_events` to `yes` in `/etc/audit/auditd.conf`. This is the default setting. | If option `local_events` isn't set to `yes` only events from network will be aggregated. |
CM-6 AU-3 | N/A | Resolve information before writing to audit logs | To configure Audit daemon to resolve all uid, gid, syscall, architecture, and socket address information before writing the events to disk, set `log_format` to `ENRICHED` in `/etc/audit/auditd.conf`. | If option `log_format` isn't set to `ENRICHED`, the audit records will be stored in a format exactly as the kernel sends them. |
CM-6 AU-3 | N/A | Set hostname as computer node name in audit logs | To configure Audit daemon to use value returned by gethostname syscall as computer node name in the audit events, set `name_format` to `hostname` in `/etc/audit/auditd.conf`. | If option `name_format` is left at its default value of `none`, audit events from different computers may be hard to distinguish. |
CM-6 | N/A | Write Audit Logs to the Disk | To configure Audit daemon to write Audit logs to the disk, set `write_logs` to `yes` in `/etc/audit/auditd.conf`. This is the default setting. | If `write_logs` isn't set to `yes`, the Audit logs will not be written to the disk. |
CM-6(a) MA-4(6) SC-13 SC-12(2) SC-12(3) | N/A | Configure Libreswan to use System Crypto Policy | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. Libreswan is supported by system crypto policy, but the Libreswan configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that the `/etc/ipsec.conf` includes the appropriate configuration file. In `/etc/ipsec.conf`, make sure that the following line is not commented out or superseded by later includes: `include /etc/crypto-policies/back-ends/libreswan.config` | Overriding the system crypto policy makes the behavior of the Libreswan service violate expectations, and makes system configuration more fragmented. |
CM-6 | N/A | Disable core dump backtraces | The `ProcessSizeMax` option in `[Coredump]` section of `/etc/systemd/coredump.conf` specifies the maximum size in bytes of a core which will be processed. Core dumps exceeding this size may be stored, but the backtrace will not be generated. | A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers or system operators trying to debug problems. Enabling core dumps on production systems is not recommended, however there may be overriding operational requirements to enable advanced debuging. Permitting temporary enablement of core dumps during such situations should be reviewed through local needs and policy. |
CM-6 | N/A | Disable storing core dump | The `Storage` option in `[Coredump]` section of `/etc/systemd/coredump.conf` can be set to `none` to disable storing core dumps permanently. | A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers or system operators trying to debug problems. Enabling core dumps on production systems is not recommended, however there may be overriding operational requirements to enable advanced debuging. Permitting temporary enablement of core dumps during such situations should be reviewed through local needs and policy. |
CM-6(a) AC-6(1) CM-6(a) | N/A | Disable Ctrl-Alt-Del Burst Action | By default, `SystemD` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed Ctrl-Alt-Delete more than 7 times in 2 seconds. To configure the system to ignore the `CtrlAltDelBurstAction` setting, add or modify the following to `/etc/systemd/system.conf`:
    CtrlAltDelBurstAction=none
| A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. |
CM-6(a) AC-6(1) | N/A | Disable Ctrl-Alt-Del Reboot Activation | By default, `SystemD` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed. To configure the system to ignore the `Ctrl-Alt-Del` key sequence from the command line instead of rebooting the system, do either of the following:
    ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target
or
    systemctl mask ctrl-alt-del.target
Do not simply delete the `/usr/lib/systemd/system/ctrl-alt-del.service` file, as this file may be restored during future system updates. | A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. |
CM-6 SC-7(10) | N/A | Disable Core Dumps for All Users | To disable core dumps for all users, add the following line to `/etc/security/limits.conf`, or to a file within the `/etc/security/limits.d/` directory:
    *     hard   core    0
| A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems. |
CM-6(a) | N/A | Extend Audit Backlog Limit for the Audit Daemon | To improve the kernel capacity to queue all log events, even those which occurred prior to the audit daemon, add the argument `audit_backlog_limit=8192` to the default GRUB 2 command line for the Linux operating system. To ensure that `audit_backlog_limit=8192` is added as a kernel command line argument to newly installed kernels, ad `audit_backlog_limit=8192` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... audit_backlog_limit=8192 ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="audit_backlog_limit=8192"
| audit_backlog_limit sets the queue length for audit events awaiting transfer to the audit daemon. Until the audit daemon is up and running, all log messages are stored in this queue. If the queue is overrun during boot process, the action defined by audit failure flag is taken. |
CM-6(a) | N/A | Enable page allocator poisoning | To enable poisoning of free pages, add the argument `page_poison=1` to the default GRUB 2 command line for the Linux operating system. To ensure that `page_poison=1` is added as a kernel command line argument to newly installed kernels, ad `page_poison=1` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... page_poison=1 ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="page_poison=1"
| Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory. |
CM-6(a) | N/A | Enable SLUB/SLAB allocator poisoning | To enable poisoning of SLUB/SLAB objects, add the argument `slub_debug=P` to the default GRUB 2 command line for the Linux operating system. To ensure that `slub_debug=P` is added as a kernel command line argument to newly installed kernels, ad `slub_debug=P` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... slub_debug=P ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="slub_debug=P"
| Poisoning writes an arbitrary value to freed objects, so any modification or reference to that object after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory. |
CM-6(a) | N/A | Set the UEFI Boot Loader Password | The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. Since plaintext passwords are a security risk, generate a hash for the password by running the following command:
    # grub2-setpassword
When prompted, enter the password that was selected. | Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode. |
CM-6 | N/A | Prevent user from disabling the screen lock | The `tmux` terminal multiplexer is used to implement automatic session locking. It should not be listed in `/etc/shells`. | Not listing `tmux` among permitted shells prevents malicious program running as user from lowering security by disabling the screen lock. |
CM-6(a) | N/A | Install AIDE | The `aide` package can be installed with the following command:
    $ sudo yum install aide
| The AIDE package must be installed if it is to be available for integrity checking. |
CM-6(a) SI-4(22) | N/A | Install fapolicyd Package | The `fapolicyd` package can be installed with the following command:
    $ sudo yum install fapolicyd
| `fapolicyd` (File Access Policy Daemon) implements application whitelisting to decide file access rights. |
CM-6(a) | N/A | Install firewalld Package | The `firewalld` package can be installed with the following command:
    $ sudo yum install firewalld
| The firewalld package should be installed to provide access control methods. |
CM-6(a) | N/A | Install the OpenSSH Server Package | The `openssh-server` package should be installed. The `openssh-server` package can be installed with the following command:
    $ sudo yum install openssh-server
| Without protection of the transmitted information, confidentiality, and integrity may be compromised because unprotected communications can be intercepted and either read or altered. |
CM-6(a) | N/A | Ensure rsyslog is Installed | Rsyslog is installed by default. The `rsyslog` package can be installed with the following command:
     $ sudo yum install rsyslog
| The rsyslog package provides the rsyslog daemon, which provides system logging services. |
CM-6(a) | N/A | Install sudo Package | The `sudo` package can be installed with the following command:
    $ sudo yum install sudo
| `sudo` is a program designed to allow a system administrator to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done. |
CM-6(a) | N/A | Install the tmux Package | To enable console screen locking, install the `tmux` package. A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. Rather than be forced to wait for a period of time to expire before the user session can be locked, Oracle Linux 8 needs to provide users with the ability to manually invoke a session lock so users can secure their session if it is necessary to temporarily vacate the immediate physical vicinity. Instruct users to begin new terminal sessions with the following command:
    $ tmux
The console can now be locked with the following key combination:
    ctrl+b :lock-session
| A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operation system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock. The `tmux` package allows for a session lock to be implemented and configured. |
CM-6(a) SC-5(2) | N/A | Ensure /home Located On Separate Partition | If user home directories will be stored locally, create a separate partition for `/home` at installation time (or migrate it later using LVM). If `/home` will be mounted from another system such as an NFS server, then creating a separate partition is not necessary at installation time, and the mountpoint can instead be configured later. | Ensuring that `/home` is mounted on its own partition enables the setting of more restrictive mount options, and also helps ensure that users cannot trivially fill partitions used for log or audit data storage. |
CM-6(a) SC-5(2) | N/A | Ensure /var Located On Separate Partition | The `/var` directory is used by daemons and other system services to store frequently-changing data. Ensure that `/var` has its own partition or logical volume at installation time, or migrate it using LVM. | Ensuring that `/var` is mounted on its own partition enables the setting of more restrictive mount options. This helps protect system services such as daemons or other programs which use it. It is not uncommon for the `/var` directory to contain world-writable directories installed by other software packages. |
CM-6(a) AU-4 SC-5(2) | N/A | Ensure /var/log Located On Separate Partition | System logs are stored in the `/var/log` directory. Ensure that `/var/log` has its own partition or logical volume at installation time, or migrate it using LVM. | Placing `/var/log` in its own partition enables better separation between log files and other files in `/var/`. |
CM-6(a) AU-4 SC-5(2) | N/A | Ensure /var/log/audit Located On Separate Partition | Audit logs are stored in the `/var/log/audit` directory. Ensure that `/var/log/audit` has its own partition or logical volume at installation time, or migrate it using LVM. Make absolutely certain that it is large enough to store all audit logs that will be created by the auditing daemon. | Placing `/var/log/audit` in its own partition enables better separation between audit files and other files, and helps ensure that auditing cannot be halted due to the partition running out of space. |
AC-6 CM-6(a) | N/A | Restrict Virtual Console Root Logins | To restrict root logins through the (deprecated) virtual console devices, ensure lines of this form do not appear in `/etc/securetty`:
    vc/1
    vc/2
    vc/3
    vc/4
| Preventing direct root login to virtual console devices helps ensure accountability for actions taken on the system using the root account. |
CM-6 | N/A | Disable debug-shell SystemD Service | SystemD's `debug-shell` service is intended to diagnose SystemD related boot issues with various `systemctl` commands. Once enabled and following a system reboot, the root shell will be available on `tty9` which is access by pressing `CTRL-ALT-F9`. The `debug-shell` service should only be used for SystemD related issues and should otherwise be disabled. By default, the `debug-shell` SystemD service is already disabled. The `debug-shell` service can be disabled with the following command:
    $ sudo systemctl mask --now debug-shell.service
| This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted. |
CM-6(a) SI-4(22) | N/A | Enable the File Access Policy Service | The File Access Policy service should be enabled. The `fapolicyd` service can be enabled with the following command:
    $ sudo systemctl enable fapolicyd.service
| The `fapolicyd` service (File Access Policy Daemon) implements application whitelisting to decide file access rights. |
AC-6 AC-17(a) CM-6(a) | N/A | Enable Use of Strict Mode Checking | SSHs `StrictModes` option checks file and ownership permissions in the user's home directory `.ssh` folder before accepting login. If world- writable permissions are found, logon is rejected. The default SSH configuration has `StrictModes` enabled. The appropriate configuration is used if no value is set for `StrictModes`. To explicitly enable `StrictModes` in SSH, add or correct the following line in `/etc/ssh/sshd_config`:
    StrictModes yes
| If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user. |
CM-6(a) AC-17(a) AC-2(5) AC-12 AC-17(a) SC-10 CM-6(a) | N/A | Set SSH Idle Timeout Interval | SSH allows administrators to set an idle timeout interval. After this interval has passed, the idle user will be automatically logged out. To set an idle timeout interval, edit the following line in `/etc/ssh/sshd_config` as follows:
    ClientAliveInterval 14_minutes
The timeout interval is given in seconds. For example, have a timeout of 10 minutes, set interval to 600. If a shorter timeout has already been set for the login shell, that value will preempt any SSH setting made in `/etc/ssh/sshd_config`. Keep in mind that some processes may stop SSH from correctly detecting that the user is idle. | Terminating an idle ssh session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been let unattended. | sshd_idle_timeout_value=14_minutes
CM-6(a) AC-6(1) | N/A | Enable Kernel Parameter to Enforce DAC on Hardlinks | To set the runtime status of the `fs.protected_hardlinks` kernel parameter, run the following command:
    $ sudo sysctl -w fs.protected_hardlinks=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    fs.protected_hardlinks = 1
| By enabling this kernel parameter, users can no longer create soft or hard links to files which they do not own. Disallowing such hardlinks mitigate vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of `open()` or `creat()`. |
CM-6(a) AC-6(1) | N/A | Enable Kernel Parameter to Enforce DAC on Symlinks | To set the runtime status of the `fs.protected_symlinks` kernel parameter, run the following command:
    $ sudo sysctl -w fs.protected_symlinks=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    fs.protected_symlinks = 1
| By enabling this kernel parameter, symbolic links are permitted to be followed only when outside a sticky world-writable directory, or when the UID of the link and follower match, or when the directory owner matches the symlink's owner. Disallowing such symlinks helps mitigate vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of `open()` or `creat()`. |
CM-6 | N/A | Disable Kernel Image Loading | To set the runtime status of the `kernel.kexec_load_disabled` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.kexec_load_disabled=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.kexec_load_disabled = 1
| Disabling kexec_load allows greater control of the kernel memory. It makes it impossible to load another kernel image after it has been disabled. |
AC-6 | N/A | Disallow kernel profiling by unprivileged users | To set the runtime status of the `kernel.perf_event_paranoid` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.perf_event_paranoid=2
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.perf_event_paranoid = 2
| Kernel profiling can reveal sensitive information about kernel behaviour. |
AC-6 SC-7(10) | N/A | Disable Access to Network bpf() Syscall From Unprivileged Processes | To set the runtime status of the `kernel.unprivileged_bpf_disabled` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.unprivileged_bpf_disabled=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.unprivileged_bpf_disabled = 1
| Loading and accessing the packet filters programs and maps using the bpf() syscall has the potential of revealing sensitive information about the kernel state. |
CM-6 SC-7(10) | N/A | Harden the operation of the BPF just-in-time compiler | To set the runtime status of the `net.core.bpf_jit_harden` kernel parameter, run the following command:
    $ sudo sysctl -w net.core.bpf_jit_harden=2
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.core.bpf_jit_harden = 2
| When hardened, the extended Berkeley Packet Filter just-in-time compiler will randomize any kernel addresses in the BPF programs and maps, and will not expose the JIT addresses in `/proc/kallsyms`. |
AC-6(1) CM-6(a) | N/A | Ensure the Default Bash Umask is Set Correctly | To ensure the default umask for users of the Bash shell is set properly, add or correct the `umask` setting in `/etc/bashrc` to read as follows:
    umask 027
| The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users. | var_accounts_user_umask=027
AC-6(1) CM-6(a) | N/A | Ensure the Default C Shell Umask is Set Correctly | To ensure the default umask for users of the C shell is set properly, add or correct the `umask` setting in `/etc/csh.cshrc` to read as follows:
    umask 027
| The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users. | var_accounts_user_umask=027
AC-6(1) CM-6(a) | N/A | Ensure the Default Umask is Set Correctly in /etc/profile | To ensure the default umask controlled by `/etc/profile` is set properly, add or correct the `umask` setting in `/etc/profile` to read as follows:
    umask 027
| The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users. | var_accounts_user_umask=027
AC-6(2) AC-17(a) IA-2 IA-2(5) CM-7(a) CM-7(b) CM-6(a) | N/A | Disable SSH Root Login | The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line in `/etc/ssh/sshd_config`:
    PermitRootLogin no
| Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account provides individual accountability of actions performed on the system and also helps to minimize direct attack attempts on root's password. |
CM-7(a) | N/A | Disable vsyscalls | To disable use of virtual syscalls, add the argument `vsyscall=none` to the default GRUB 2 command line for the Linux operating system. To ensure that `vsyscall=none` is added as a kernel command line argument to newly installed kernels, ad `vsyscall=none` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... vsyscall=none ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="vsyscall=none"
| Virtual Syscalls provide an opportunity of attack for a user who has control of the return instruction pointer. |
CM-7(a) CM-7(b) CM-6(a) | N/A | Disable Mounting of cramfs | To configure the system to prevent the `cramfs` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install cramfs /bin/true
This effectively prevents usage of this uncommon filesystem. The `cramfs` filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A `cramfs` image can be used without having to first decompress the image. | Removing support for unneeded filesystem types reduces the local attack surface of the server. |
CM-7(a) CM-7(b) CM-6(a) | N/A | Disable SCTP Support | The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. To configure the system to prevent the `sctp` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install sctp /bin/true
| Disabling SCTP protects the system against exploitation of any flaws in its implementation. |
CM-7(a) CM-7(b) CM-6(a) | N/A | Disable TIPC Support | The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communications between nodes in a cluster. To configure the system to prevent the `tipc` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install tipc /bin/true
| Disabling TIPC protects the system against exploitation of any flaws in its implementation. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add nodev Option to /boot | The `nodev` mount option can be used to prevent device files from being created in `/boot`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add nosuid Option to /boot | The `nosuid` mount option can be used to prevent execution of setuid programs in `/boot`. The SUID and SGID permissions should not be required on the boot partition. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot`. | The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from boot partitions. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add nodev Option to /dev/shm | The `nodev` mount option can be used to prevent creation of device files in `/dev/shm`. Legitimate character and block devices should not exist within temporary directories like `/dev/shm`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add noexec Option to /dev/shm | The `noexec` mount option can be used to prevent binaries from being executed out of `/dev/shm`. It can be dangerous to allow the execution of binaries from world-writable temporary storage directories such as `/dev/shm`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`. | Allowing users to execute binaries from world-writable directories such as `/dev/shm` can expose the system to potential compromise. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add nosuid Option to /dev/shm | The `nosuid` mount option can be used to prevent execution of setuid programs in `/dev/shm`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`. | The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add nosuid Option to /home | The `nosuid` mount option can be used to prevent execution of setuid programs in `/home`. The SUID and SGID permissions should not be required in these user data directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`. | The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from user home directory partitions. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add nodev Option to Non-Root Local Partitions | The `nodev` mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of any non-root local partitions. | The `nodev` mount option prevents files from being interpreted as character or block devices. The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails, for which it is not advised to set `nodev` on these filesystems. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add nodev Option to /tmp | The `nodev` mount option can be used to prevent device files from being created in `/tmp`. Legitimate character and block devices should not exist within temporary directories like `/tmp`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add noexec Option to /tmp | The `noexec` mount option can be used to prevent binaries from being executed out of `/tmp`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`. | Allowing users to execute binaries from world-writable directories such as `/tmp` should never be necessary in normal operation and can expose the system to potential compromise. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add nosuid Option to /tmp | The `nosuid` mount option can be used to prevent execution of setuid programs in `/tmp`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`. | The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add nodev Option to /var/log/audit | The `nodev` mount option can be used to prevent device files from being created in `/var/log/audit`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add noexec Option to /var/log/audit | The `noexec` mount option can be used to prevent binaries from being executed out of `/var/log/audit`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`. | Allowing users to execute binaries from directories containing audit log files such as `/var/log/audit` should never be necessary in normal operation and can expose the system to potential compromise. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add nosuid Option to /var/log/audit | The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/log/audit`. The SUID and SGID permissions should not be required in directories containing audit log files. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`. | The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from partitions designated for audit log files. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add nodev Option to /var/log | The `nodev` mount option can be used to prevent device files from being created in `/var/log`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add noexec Option to /var/log | The `noexec` mount option can be used to prevent binaries from being executed out of `/var/log`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`. | Allowing users to execute binaries from directories containing log files such as `/var/log` should never be necessary in normal operation and can expose the system to potential compromise. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add nosuid Option to /var/log | The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/log`. The SUID and SGID permissions should not be required in directories containing log files. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`. | The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from partitions designated for log files. |
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | N/A | Add nodev Option to /var | The `nodev` mount option can be used to prevent device files from being created in `/var`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails. |
AC-7(a) AU-7(1) AU-7(2) AU-14 AU-12(2) AU-2(a) CM-6(a) | N/A | Ensure the audit Subsystem is Installed | The audit package should be installed. | The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy. |
CM-7(a) CM-7(b) CM-6(a) | N/A | Uninstall Sendmail Package | Sendmail is not the default mail transfer agent and is not installed by default. The `sendmail` package can be removed with the following command:
    $ sudo yum erase sendmail
| The sendmail software was not developed with security in mind and its design prevents it from being effectively contained by SELinux. Postfix should be used instead. |
CM-7(a) CM-7(b) CM-6(a) | N/A | Disable KDump Kernel Crash Analyzer (kdump) | The `kdump` service provides a kernel crash dump analyzer. It uses the `kexec` system call to boot a secondary kernel ("capture" kernel) following a system crash, which can load information from the crashed kernel for analysis. The `kdump` service can be disabled with the following command:
    $ sudo systemctl mask --now kdump.service
| Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps consume a considerable amount of disk space and may result in denial of service by exhausting the available space on the target file system partition. Unless the system is used for kernel development or testing, there is little need to run the kdump service. |
CM-7(a) CM-7(b) CM-6(a) AC-17(a) | N/A | Disable GSSAPI Authentication | Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms like GSSAPI. The default SSH configuration disallows authentications based on GSSAPI. The appropriate configuration is used if no value is set for `GSSAPIAuthentication`. To explicitly disable GSSAPI authentication, add or correct the following line in `/etc/ssh/sshd_config`:
    GSSAPIAuthentication no
| GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system. |
CM-7(a) CM-7(b) CM-6(a) SC-7(a) | N/A | Disable Accepting ICMP Redirects for All IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.accept_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.accept_redirects = 0
| ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required." |
CM-7(a) CM-7(b) SC-5 CM-6(a) SC-7(a) | N/A | Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.accept_source_route` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.accept_source_route = 0
| Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required. |
CM-7(a) CM-7(b) SC-5(3)(a) | N/A | Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.log_martians` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.log_martians=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.log_martians = 1
| The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected. |
CM-7(a) CM-7(b) CM-6(a) SC-7(a) | N/A | Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.rp_filter` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.rp_filter=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.rp_filter = 1
| Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks. |
CM-7(a) CM-7(b) CM-6(a) SC-7(a) | N/A | Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.secure_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.secure_redirects = 0
| Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required. |
CM-7(a) CM-7(b) SC-5 CM-6(a) SC-7(a) | N/A | Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.send_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.send_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.send_redirects = 0
| ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers. |
CM-7(a) CM-7(b) CM-6(a) SC-7(a) | N/A | Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.default.accept_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.accept_redirects = 0
| ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required. |
CM-7(a) CM-7(b) SC-5 SC-7(a) | N/A | Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default | To set the runtime status of the `net.ipv4.conf.default.accept_source_route` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.accept_source_route = 0
| Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required, such as when IPv4 forwarding is enabled and the system is legitimately functioning as a router. |
CM-7(a) CM-7(b) SC-5(3)(a) | N/A | Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default | To set the runtime status of the `net.ipv4.conf.default.log_martians` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.log_martians=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.log_martians = 1
| The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected. |
CM-7(a) CM-7(b) CM-6(a) SC-7(a) | N/A | Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default | To set the runtime status of the `net.ipv4.conf.default.rp_filter` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.rp_filter=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.rp_filter = 1
| Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks. |
CM-7(a) CM-7(b) SC-5 SC-7(a) | N/A | Configure Kernel Parameter for Accepting Secure Redirects By Default | To set the runtime status of the `net.ipv4.conf.default.secure_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.secure_redirects = 0
| Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required. |
CM-7(a) CM-7(b) SC-5 CM-6(a) SC-7(a) | N/A | Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default | To set the runtime status of the `net.ipv4.conf.default.send_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.send_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.send_redirects = 0
| ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers. |
CM-7(a) CM-7(b) SC-5 | N/A | Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces | To set the runtime status of the `net.ipv4.icmp_echo_ignore_broadcasts` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.icmp_echo_ignore_broadcasts = 1
| Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks. Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network. |
CM-7(a) CM-7(b) SC-5 | N/A | Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces | To set the runtime status of the `net.ipv4.icmp_ignore_bogus_error_responses` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.icmp_ignore_bogus_error_responses = 1
| Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged. |
CM-7(a) CM-7(b) SC-5 CM-6(a) SC-7(a) | N/A | Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces | To set the runtime status of the `net.ipv4.ip_forward` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.ip_forward=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.ip_forward = 0
| Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this capability is used when not required, system network information may be unnecessarily transmitted across the network. |
CM-7(a) CM-7(b) SC-5(1) SC-5(2) SC-5(3)(a) CM-6(a) | N/A | Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces | To set the runtime status of the `net.ipv4.tcp_syncookies` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.tcp_syncookies=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.tcp_syncookies = 1
| A TCP SYN flood attack can cause a denial of service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies can be used to track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This feature is activated when a flood condition is detected, and enables the system to continue servicing valid connection requests. |
CM-7(a) CM-7(b) CM-6(a) | N/A | Configure Accepting Router Advertisements on All IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.accept_ra` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.accept_ra=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.accept_ra = 0
| An illicit router advertisement message could result in a man-in-the-middle attack. |
CM-7(a) CM-7(b) CM-6(a) CM-6(b) CM-6.1(iv) | N/A | Disable Accepting ICMP Redirects for All IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.accept_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.accept_redirects = 0
| An illicit ICMP redirect message could result in a man-in-the-middle attack. |
CM-7(a) CM-7(b) CM-6(a) | N/A | Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.accept_source_route` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.accept_source_route = 0
| Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required. |
CM-7(a) CM-7(b) CM-6(a) | N/A | Disable Accepting Router Advertisements on all IPv6 Interfaces by Default | To set the runtime status of the `net.ipv6.conf.default.accept_ra` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.accept_ra=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.accept_ra = 0
| An illicit router advertisement message could result in a man-in-the-middle attack. |
CM-7(a) CM-7(b) CM-6(a) | N/A | Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.default.accept_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.accept_redirects = 0
| An illicit ICMP redirect message could result in a man-in-the-middle attack. |
CM-7(a) CM-7(b) CM-6(a) CM-6(b) CM-6.1(iv) | N/A | Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default | To set the runtime status of the `net.ipv6.conf.default.accept_source_route` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.accept_source_route = 0
| Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required. |
CM-7(1) | N/A | Disable network management of chrony daemon | The `cmdport` option in `/etc/chrony.conf` can be set to `0` to stop chrony daemon from listening on the UDP port 323 for management connections made by chronyc. | Not exposing the management interface of the chrony daemon on the network diminishes the attack space. |
SC-7(10) | N/A | Disable acquiring, saving, and processing core dumps | The `systemd-coredump.socket` unit is a socket activation of the `systemd-coredump@.service` which processes core dumps. By masking the unit, core dump processing is disabled. | A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems. |
SC-7(10) | N/A | Disable storing core dumps | To set the runtime status of the `kernel.core_pattern` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.core_pattern=|/bin/false
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.core_pattern = |/bin/false
| A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems. |
SC-7(10) | N/A | Restrict usage of ptrace to descendant processes | To set the runtime status of the `kernel.yama.ptrace_scope` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.yama.ptrace_scope=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.yama.ptrace_scope = 1
| Unrestricted usage of ptrace allows compromised binaries to run ptrace on another processes of the user. Like this, the attacker can steal sensitive information from the target processes (e.g. SSH sessions, web browser, ...) without any additional assistance from the user (i.e. without resorting to phishing). |
AC-8(a) AC-8(c) AC-17(a) CM-6(a) | N/A | Enable SSH Warning Banner | To enable the warning banner and ensure it is consistent across the system, add or correct the following line in `/etc/ssh/sshd_config`:
    Banner /etc/issue
Another section contains information on how to create an appropriate system-wide warning banner. | The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution. |
AU-8(1) | N/A | Disable chrony daemon from acting as server | The `port` option in `/etc/chrony.conf` can be set to `0` to make chrony daemon to never open any listening port for server operation and to operate strictly in a client-only mode. | Minimizing the exposure of the server functionality of the chrony daemon diminishes the attack surface. |
CM-8(3) IA-3 | N/A | Install usbguard Package | The `usbguard` package can be installed with the following command:
    $ sudo yum install usbguard
| `usbguard` is a software framework that helps to protect against rogue USB devices by implementing basic whitelisting/blacklisting capabilities based on USB device attributes. |
CM-8(3)(a) IA-3 | N/A | Enable the USBGuard Service | The USBGuard service should be enabled. The `usbguard` service can be enabled with the following command:
    $ sudo systemctl enable usbguard.service
| The `usbguard` service must be running in order to enforce the USB device authorization policy for all USB devices. |
CM-8(3) IA-3 | N/A | Authorize Human Interface Devices and USB hubs in USBGuard daemon | To allow authorization of USB devices combining human interface device and hub capabilities by USBGuard daemon, add the line `allow with-interface match-all { 03:*:* 09:00:* }` to `/etc/usbguard/rules.conf`. | Without allowing Human Interface Devices, it might not be possible to interact with the system. Without allowing hubs, it might not be possible to use any USB devices on the system. |
AU-9(3) CM-6(a) | N/A | Configure TLS for rsyslog remote logging | Configure `rsyslog` to use Transport Layer Security (TLS) support for logging to remote server for the Forwarding Output Module in `/etc/rsyslog.conf` using action. You can use the following command:
    echo 'action(type="omfwd" protocol="tcp" Target="<remote system>" port="6514"
        StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" streamdriver.CheckExtendedKeyPurpose="on")' >> /etc/rsyslog.conf
Replace the `<remote system>` in the above command with an IP address or a host name of the remote logging server. | For protection of data being logged, the connection to the remote logging server needs to be authenticated and encrypted. |
AC-10 CM-6(a) | N/A | Limit the Number of Concurrent Login Sessions Allowed Per User | Limiting the number of allowed users and sessions per user can limit risks related to Denial of Service attacks. This addresses concurrent sessions for a single account and does not address concurrent sessions by a single user via multiple accounts. To set the number of concurrent sessions per user add the following line in `/etc/security/limits.conf` or a file under `/etc/security/limits.d/`:
    * hard maxlogins 10
| Limiting simultaneous user logins can insulate the system from denial of service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions. | var_accounts_max_concurrent_login_sessions=10
AU-11 CM-6(a) | N/A | Configure auditd flush priority | The `auditd` service can be configured to synchronously write audit event data to disk. Add or correct the following line in `/etc/audit/auditd.conf` to ensure that audit event data is fully synchronized with the log files on the disk:
    flush = incremental_async
| Audit data should be synchronously written to disk to ensure log integrity. These parameters assure that all audit event data is fully synchronized with the log files on the disk. | var_auditd_flush=incremental_async
AC-11(a) AC-11(b) CM-6(a) | N/A | Configure the tmux Lock Command | To enable console screen locking in `tmux` terminal multiplexer, the `vlock` command must be configured to be used as a locking mechanism. Add the following line to `/etc/tmux.conf`:
    set -g lock-command vlock
. The console can now be locked with the following key combination:
    ctrl+b :lock-session
| The `tmux` package allows for a session lock to be implemented and configured. However, the session lock is implemented by an external command. The `tmux` default configuration does not contain an effective session lock. |
CM-11(a) CM-11(b) CM-6(a) CM-5(3) SA-12 SA-12(10) | N/A | Ensure gpgcheck Enabled for Local Packages | `yum` should be configured to verify the signature(s) of local packages prior to installation. To configure `yum` to verify signatures of local packages, set the `localpkg_gpgcheck` to `1` in `/etc/yum.conf`. | Changes to any software components can have significant effects to the overall security of the operating system. This requirement ensures the software has not been tampered and has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. |
SI-11(a) SI-11(b) | N/A | Restrict Access to Kernel Message Buffer | To set the runtime status of the `kernel.dmesg_restrict` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.dmesg_restrict=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.dmesg_restrict = 1
| Unprivileged access to the kernel syslog can expose sensitive kernel address information. |
SC-12(2) SC-12(3) IA-7 SC-13 CM-6(a) SC-12 | N/A | Enable Dracut FIPS Module | To enable FIPS mode, run the following command:
    fips-mode-setup --enable
To enable FIPS, the system requires that the `fips` module is added in `dracut` configuration. Check if `/etc/dracut.conf.d/40-fips.conf` contain `add_dracutmodules+=" fips "` | Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. |
SC-12(2) SC-12(3) IA-7 SC-13 CM-6(a) SC-12 | N/A | Enable FIPS Mode | To enable FIPS mode, run the following command:
    fips-mode-setup --enable
The `fips-mode-setup` command will configure the system in FIPS mode by automatically configuring the following: Setting the kernel FIPS mode flag (`/proc/sys/crypto/fips_enabled`) to `1` Creating `/etc/system-fips` Setting the system crypto policy in `/etc/crypto-policies/config` to ``fips_ospp`` Loading the Dracut `fips` module | Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. | var_system_crypto_policy=fips_ospp
SC-13 SC-12(2) SC-12(3) | N/A | Configure BIND to use System Crypto Policy | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. BIND is supported by crypto policy, but the BIND configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that the `/etc/named.conf` includes the appropriate configuration: In the `options` section of `/etc/named.conf`, make sure that the following line is not commented out or superseded by later includes: `include "/etc/crypto-policies/back-ends/bind.config";` | Overriding the system crypto policy makes the behavior of the BIND service violate expectations, and makes system configuration more fragmented. |
SC-13 SC-12(2) SC-12(3) | N/A | Configure Kerberos to use System Crypto Policy | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. Kerberos is supported by crypto policy, but it's configuration may be set up to ignore it. To check that Crypto Policies settings for Kerberos are configured correctly, examine that there is a symlink at /etc/krb5.conf.d/crypto-policies targeting /etc/cypto-policies/back-ends/krb5.config. If the symlink exists, kerberos is configured to use the system-wide crypto policy settings. | Overriding the system crypto policy makes the behavior of Kerberos violate expectations, and makes system configuration more fragmented. |
SI-16 | N/A | Enable Kernel Page-Table Isolation (KPTI) | To enable Kernel page-table isolation, add the argument `pti=on` to the default GRUB 2 command line for the Linux operating system. To ensure that `pti=on` is added as a kernel command line argument to newly installed kernels, ad `pti=on` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... pti=on ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="pti=on"
| Kernel page-table isolation is a kernel feature that mitigates the Meltdown security vulnerability and hardens the kernel against attempts to bypass kernel address space layout randomization (KASLR). |
AC-17(a) AC-17(2) CM-6(a) MA-4(6) SC-13 SC-12(2) SC-12(3) | N/A | Configure System Cryptography Policy | To configure the system cryptography policy to use ciphers only from the ``fips_ospp`` policy, run the following command:
    $ sudo update-crypto-policies --set fips_ospp
The rule checks if settings for selected crypto policy are configured as expected. Configuration files in the `/etc/crypto-policies/back-ends` are either symlinks to correct files provided by Crypto-policies package or they are regular files in case crypto policy customizations are applied. Crypto policies may be customized by crypto policy modules, in which case it is delimited from the base policy using a colon. | Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. | var_system_crypto_policy=fips_ospp
AC-17(a) AC-17(2) CM-6(a) MA-4(6) SC-13 SC-12(2) SC-12(3) | N/A | Configure OpenSSL library to use System Crypto Policy | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. OpenSSL is supported by crypto policy, but the OpenSSL configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, you have to examine the OpenSSL config file available under `/etc/pki/tls/openssl.cnf`. This file has the `ini` format, and it enables crypto policy support if there is a `[ crypto_policy ]` section that contains the `.include /etc/crypto-policies/back-ends/opensslcnf.config` directive. | Overriding the system crypto policy makes the behavior of the Java runtime violates expectations, and makes system configuration more fragmented. |
AC-17(a) AC-17(2) CM-6(a) MA-4(6) SC-13 | N/A | Configure SSH to use System Crypto Policy | Crypto Policies provide a centralized control over crypto algorithms usage of many packages. SSH is supported by crypto policy, but the SSH configuration may be set up to ignore it. To check that Crypto Policies settings are configured correctly, ensure that the `CRYPTO_POLICY` variable is either commented or not set at all in the `/etc/sysconfig/sshd`. | Overriding the system crypto policy makes the behavior of the SSH service violate expectations, and makes system configuration more fragmented. |
AC-17(a) CM-7(a) CM-7(b) CM-6(a) | N/A | Disable SSH Access via Empty Passwords | Disallow SSH login with empty passwords. The default SSH configuration disables logins with empty passwords. The appropriate configuration is used if no value is set for `PermitEmptyPasswords`. To explicitly disallow SSH login from accounts with empty passwords, add or correct the following line in `/etc/ssh/sshd_config`:
    PermitEmptyPasswords no
Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords. | Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere. |
AC-17(a) CM-7(a) CM-7(b) CM-6(a) | N/A | Disable Kerberos Authentication | Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms like Kerberos. The default SSH configuration disallows authentication validation through Kerberos. The appropriate configuration is used if no value is set for `KerberosAuthentication`. To explicitly disable Kerberos authentication, add or correct the following line in `/etc/ssh/sshd_config`:
    KerberosAuthentication no
| Kerberos authentication for SSH is often implemented using GSSAPI. If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementations may be subject to exploitation. |
AC-17(1) AU-14(1) AU-10 CM-6(a) IR-5(1) | N/A | Enable Auditing for Processes Which Start Prior to the Audit Daemon | To ensure all processes can be audited, even those which start prior to the audit daemon, add the argument `audit=1` to the default GRUB 2 command line for the Linux operating system. To ensure that `audit=1` is added as a kernel command line argument to newly installed kernels, ad `audit=1` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... audit=1 ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="audit=1"
| Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although `auditd` takes care of enabling this for all processes which launch after it does, adding the kernel argument ensures it is set for every process during boot. |
AC-18 | N/A | Disable ATM Support | The Asynchronous Transfer Mode (ATM) is a protocol operating on network, data link, and physical layers, based on virtual circuits and virtual paths. To configure the system to prevent the `atm` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install atm /bin/true
| Disabling ATM protects the system against exploitation of any flaws in its implementation. |
AC-18(a) AC-18(3) CM-7(a) CM-7(b) CM-6(a) MP-7 | N/A | Disable Bluetooth Kernel Module | The kernel's module loading system can be configured to prevent loading of the Bluetooth module. Add the following to the appropriate `/etc/modprobe.d` configuration file to prevent the loading of the Bluetooth module:
    install bluetooth /bin/true
| If Bluetooth functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation. |
AC-18 | N/A | Disable CAN Support | The Controller Area Network (CAN) is a serial communications protocol which was initially developed for automotive and is now also used in marine, industrial, and medical applications. To configure the system to prevent the `can` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install can /bin/true
| Disabling CAN protects the system against exploitation of any flaws in its implementation. |
AC-18 | N/A | Disable IEEE 1394 (FireWire) Support | The IEEE 1394 (FireWire) is a serial bus standard for high-speed real-time communication. To configure the system to prevent the `firewire-core` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install firewire-core /bin/true
| Disabling FireWire protects the system against exploitation of any flaws in its implementation. |
SC-30 SC-30(2) SC-30(5) CM-6(a) | N/A | Restrict Exposed Kernel Pointer Addresses Access | To set the runtime status of the `kernel.kptr_restrict` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.kptr_restrict=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.kptr_restrict = 1
| Exposing kernel pointers (through procfs or `seq_printf()`) exposes kernel writeable structures that can contain functions pointers. If a write vulnereability occurs in the kernel allowing a write access to any of this structure, the kernel can be compromise. This option disallow any program withtout the CAP_SYSLOG capability from getting the kernel pointers addresses, replacing them with 0. | sysctl_kernel_kptr_restrict_value=1
SC-39 CM-6(a) | N/A | Disable the use of user namespaces | To set the runtime status of the `user.max_user_namespaces` kernel parameter, run the following command:
    $ sudo sysctl -w user.max_user_namespaces=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    user.max_user_namespaces = 0
When containers are deployed on the machine, the value should be set to large non-zero value. | User namespaces are used primarily for Linux containers. The value 0 disallows the use of user namespaces. |
| N/A | Support session locking with tmux | The `tmux` terminal multiplexer is used to implement automatic session locking. It should be started from `/etc/bashrc` or drop-in files within `/etc/profile.d/`. | Unlike `bash` itself, the `tmux` terminal multiplexer provides a mechanism to lock sessions after period of inactivity. |
| N/A | Configure tmux to lock session after inactivity | To enable console screen locking in `tmux` terminal multiplexer after a period of inactivity, the `lock-after-time` option has to be set to nonzero value in `/etc/tmux.conf`. | Locking the session after a period of inactivity limits the potential exposure if the session is left unattended. |
| N/A | Configure kernel to trust the CPU random number generator | There exist two ways how to ensure that the Linux kernel trusts the CPU hardware random number generator. If the option is configured during kernel compilation, e.g. the option `CONFIG_RANDOM_TRUST_CPU` is set to `Y`, make sure that it is not overridden with the boot parameter. There must not exist the boot parameter `random.trust_cpu=off`. If the option is not compiled in, make sure that `random.trust_cpu=on` is configured as a boot parameter. To ensure that `random.trust_cpu=on` is added as a kernel command line argument to newly installed kernels, ad `random.trust_cpu=on` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... random.trust_cpu=on ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="random.trust_cpu=on"
| The Linux kernel offers an option which signifies if the kernel should trust data provided by CPU hardware random number generator. Hardware random number generators can provide random data very quickly and are used to generate random cryptographic keys. They can be useful during boot time when other means of getting random data can be slow because there is not yet enough entropy in the system. |
| N/A | Disable Kerberos by removing host keytab | Kerberos is not an approved key distribution method for Common Criteria. To prevent using Kerberos by system daemons, remove the Kerberos keytab files, especially `/etc/krb5.keytab`. | The key derivation function (KDF) in Kerberos is not FIPS compatible. |
| N/A | Add nodev Option to /home | The `nodev` mount option can be used to prevent device files from being created in `/home`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails. |
| N/A | Add nodev Option to /var/tmp | The `nodev` mount option can be used to prevent device files from being created in `/var/tmp`. Legitimate character and block devices should not exist within temporary directories like `/var/tmp`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails. |
| N/A | Add noexec Option to /var/tmp | The `noexec` mount option can be used to prevent binaries from being executed out of `/var/tmp`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`. | Allowing users to execute binaries from world-writable directories such as `/var/tmp` should never be necessary in normal operation and can expose the system to potential compromise. |
| N/A | Add nosuid Option to /var/tmp | The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/tmp`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`. | The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions. |
| N/A | OpenSSL uses strong entropy source | By default, OpenSSL doesn't always use a SP800-90A compliant random number generator. A way to configure OpenSSL to always use a strong source is to setup a wrapper that defines a shell function that shadows the actual `openssl` binary, and that ensures that the `-rand /dev/random` option is added to every `openssl` invocation. To do so, place the following shell snippet exactly as-is to `/etc/profile.d/openssl-rand.sh`:
    # provide a default -rand /dev/random option to openssl commands that
    # support it

    # written inefficiently for maximum shell compatibility
    openssl()
    (
      openssl_bin=/usr/bin/openssl

      case "$*" in
        # if user specified -rand, honor it
        *\ -rand\ *|*\ -help*) exec $openssl_bin "$@" ;;
      esac

      cmds=`$openssl_bin list -digest-commands -cipher-commands | tr '\n' ' '`
      for i in `$openssl_bin list -commands`; do
        if $openssl_bin list -options "$i" | grep -q '^rand '; then
          cmds=" $i $cmds"
        fi
      done

      case "$cmds" in
        *\ "$1"\ *)
          cmd="$1"; shift
          exec $openssl_bin "$cmd" -rand /dev/random "$@" ;;
      esac

      exec $openssl_bin "$@"
    )
| This rule ensures that `openssl` invocations always uses SP800-90A compliant random number generator as a default behavior. |
| N/A | Uninstall abrt-addon-ccpp Package | The `abrt-addon-ccpp` package can be removed with the following command:
    $ sudo yum erase abrt-addon-ccpp
| `abrt-addon-ccpp` contains hooks for C/C++ crashed programs and `abrt`'s C/C++ analyzer plugin. |
| N/A | Uninstall abrt-addon-kerneloops Package | The `abrt-addon-kerneloops` package can be removed with the following command:
    $ sudo yum erase abrt-addon-kerneloops
| `abrt-addon-kerneloops` contains plugins for collecting kernel crash information and reporter plugin which sends this information to a specified server, usually to kerneloops.org. |
| N/A | Uninstall abrt-cli Package | The `abrt-cli` package can be removed with the following command:
    $ sudo yum erase abrt-cli
| `abrt-cli` contains a command line client for controlling abrt daemon over sockets. |
| N/A | Uninstall abrt-plugin-sosreport Package | The `abrt-plugin-sosreport` package can be removed with the following command:
    $ sudo yum erase abrt-plugin-sosreport
| `abrt-plugin-sosreport` provides a plugin to include an sosreport in an ABRT report. |
| N/A | Uninstall Automatic Bug Reporting Tool (abrt) | The Automatic Bug Reporting Tool (`abrt`) collects and reports crash data when an application crash is detected. Using a variety of plugins, abrt can email crash reports to system administrators, log crash reports to files, or forward crash reports to a centralized issue tracking system such as RHTSupport. The `abrt` package can be removed with the following command:
    $ sudo yum erase abrt
| Mishandling crash data could expose sensitive information about vulnerabilities in software executing on the system, as well as sensitive information from within a process's address space or registers. |
| N/A | Install audispd-plugins Package | The `audispd-plugins` package can be installed with the following command:
    $ sudo yum install audispd-plugins
| `audispd-plugins` provides plugins for the real-time interface to the audit subsystem, `audispd`. These plugins can do things like relay events to remote machines or analyze events for suspicious behavior. |
| N/A | The Chrony package is installed | System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all systems synchronize their clocks to them. The `chrony` package can be installed with the following command:
    $ sudo yum install chrony
| Time synchronization is important to support time sensitive security mechanisms like Kerberos and also ensures log files have consistent time records across the enterprise, which aids in forensic investigations. |
| N/A | Install crypto-policies package | The `crypto-policies` package can be installed with the following command:
    $ sudo yum install crypto-policies
| Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. |
| N/A | Install dnf-automatic Package | The `dnf-automatic` package can be installed with the following command:
    $ sudo yum install dnf-automatic
| `dnf-automatic` is an alternative command line interface (CLI) to `dnf upgrade` suitable for automatic, regular execution. |
| N/A | Ensure gnutls-utils is installed | The `gnutls-utils` package can be installed with the following command:
    $ sudo yum install gnutls-utils
| GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and other required structures. This package contains command line TLS client and server and certificate manipulation tools. |
| N/A | Uninstall gssproxy Package | The `gssproxy` package can be removed with the following command:
    $ sudo yum erase gssproxy
| `gssproxy` is a proxy for GSS API credential handling. |
| N/A | Uninstall iprutils Package | The `iprutils` package can be removed with the following command:
    $ sudo yum erase iprutils
| `iprutils` provides a suite of utlilities to manage and configure SCSI devices supported by the ipr SCSI storage device driver. |
| N/A | Uninstall krb5-workstation Package | The `krb5-workstation` package can be removed with the following command:
    $ sudo yum erase krb5-workstation
| Kerberos is a network authentication system. The `krb5-workstation` package contains the basic Kerberos programs (`kinit`, `klist`, `kdestroy`, `kpasswd`). Currently, Kerberos does not utilize FIPS 140-2 cryptography and is not permitted on Government networks, nor is it permitted in many regulatory environments such as HIPAA. |
| N/A | Uninstall libreport-plugin-logger Package | The `libreport-plugin-logger` package can be removed with the following command:
    $ sudo yum erase libreport-plugin-logger
| `libreport-plugin-logger` is a ABRT plugin to report bugs into the Red Hat Support system. |
| N/A | Uninstall libreport-plugin-rhtsupport Package | The `libreport-plugin-rhtsupport` package can be removed with the following command:
    $ sudo yum erase libreport-plugin-rhtsupport
| `libreport-plugin-rhtsupport` is a ABRT plugin to report bugs into the Red Hat Support system. |
| N/A | Uninstall nfs-utils Package | The `nfs-utils` package can be removed with the following command:
    $ sudo yum erase nfs-utils
| `nfs-utils` provides a daemon for the kernel NFS server and related tools. This package also contains the `showmount` program. `showmount` queries the mount daemon on a remote host for information about the Network File System (NFS) server on the remote host. For example, `showmount` can display the clients which are mounted on that host. |
| N/A | Install openscap-scanner Package | The `openscap-scanner` package can be installed with the following command:
    $ sudo yum install openscap-scanner
| `openscap-scanner` contains the `oscap` command line tool. This tool is a configuration and vulnerability scanner, capable of performing compliance checking using SCAP content. |
| N/A | Install OpenSSH client software | The `openssh-clients` package can be installed with the following command:
    $ sudo yum install openssh-clients
| This package includes utilities to make encrypted connections and transfer files securely to SSH servers. |
| N/A | Install policycoreutils-python-utils package | The `policycoreutils-python-utils` package can be installed with the following command:
    $ sudo yum install policycoreutils-python-utils
| This package is required to operate and manage an SELinux environment and its policies. It provides utilities such as semanage, audit2allow, audit2why, chcat and sandbox. |
| N/A | Install policycoreutils Package | The `policycoreutils` package can be installed with the following command:
    $ sudo yum install policycoreutils
| Security-enhanced Linux is a feature of the Linux kernel and a number of utilities with enhanced security functionality designed to add mandatory access controls to Linux. The Security-enhanced Linux kernel contains new architectural components originally developed to improve security of the Flask operating system. These architectural components provide general support for the enforcement of many kinds of mandatory access control policies, including those based on the concepts of Type Enforcement, Role-based Access Control, and Multi-level Security. `policycoreutils` contains the policy core utilities that are required for basic operation of an SELinux-enabled system. These utilities include `load_policy` to load SELinux policies, `setfiles` to label filesystems, `newrole` to switch roles, and so on. |
| N/A | Ensure rsyslog-gnutls is installed | TLS protocol support for rsyslog is installed. The `rsyslog-gnutls` package can be installed with the following command:
    $ sudo yum install rsyslog-gnutls
| The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging. |
| N/A | Install scap-security-guide Package | The `scap-security-guide` package can be installed with the following command:
    $ sudo yum install scap-security-guide
| The `scap-security-guide` package provides a guide for configuration of the system from the final system's security point of view. The guidance is specified in the Security Content Automation Protocol (SCAP) format and constitutes a catalog of practical hardening advice, linked to government requirements where applicable. The SCAP Security Guide project bridges the gap between generalized policy requirements and specific implementation guidelines. A system administrator can use the `oscap` CLI tool from the `openscap-scanner` package, or the SCAP Workbench GUI tool from the `scap-workbench` package, to verify that the system conforms to provided guidelines. Refer to the scap-security-guide(8) manual page for futher information. |
| N/A | Ensure /var/tmp Located On Separate Partition | The `/var/tmp` directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM. | The `/var/tmp` partition is used as temporary storage by many programs. Placing `/var/tmp` in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it. |
| N/A | Configure CA certificate for rsyslog remote logging | Configure CA certificate for `rsyslog` logging to remote server using Transport Layer Security (TLS) using correct path for the `DefaultNetstreamDriverCAFile` global option in `/etc/rsyslog.conf`, for example with the following command:
    echo 'global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")' >> /etc/rsyslog.conf
Replace the `/etc/pki/tls/cert.pem` in the above command with the path to the file with CA certificate generated for the purpose of remote logging. | The CA certificate needs to be set or `rsyslog.service` fails to start with
    error: ca certificate is not set, cannot continue
| N/A | Configure session renegotiation for SSH client | The `RekeyLimit` parameter specifies how often the session key is renegotiated, both in terms of amount of data that may be transmitted and the time elapsed. To decrease the default limits, put line `RekeyLimit `1G` `1hour`` to file `/etc/ssh/ssh_config.d/02-rekey-limit.conf`. Make sure that there is no other `RekeyLimit` configuration preceding the `include` directive in the main config file `/etc/ssh/ssh_config`. Check also other files in `/etc/ssh/ssh_config.d` directory. Files are processed according to lexicographical order of file names. Make sure that there is no file processed before `02-rekey-limit.conf` containing definition of `RekeyLimit`. | By decreasing the limit based on the amount of data and enabling time-based limit, effects of potential attacks against encryption keys are limited. | var_ssh_client_rekey_limit_size=1G var_ssh_client_rekey_limit_time=1hour
| N/A | SSH client uses strong entropy to seed (for CSH like shells) | To set up SSH client to use entropy from a high-quality source, make sure that the appropriate shell environment variable is configured. The `SSH_USE_STRONG_RNG` environment variable determines how many bytes of entropy to use. Make sure that the file `/etc/profile.d/cc-ssh-strong-rng.csh` contains line
    setenv SSH_USE_STRONG_RNG 32
. | Some SSH implementations use the openssl library for entropy, which by default, doesn't use high-entropy sources. Randomness is needed to generate considerably more secure data-encryption keys. Plaintext padding, initialization vectors in encryption algorithms, and high-quality entropy eliminates the possibility that the output of the random number generator used by SSH would be known to potential attackers. |
| N/A | SSH client uses strong entropy to seed (Bash-like shells) | To set up SSH client to use entropy from a high-quality source, make sure that the appropriate shell environment variable is configured. The `SSH_USE_STRONG_RNG` environment variable determines how many bytes of entropy to use. Make sure that the file `/etc/profile.d/cc-ssh-strong-rng.sh` contains line
    export SSH_USE_STRONG_RNG=32
. | Some SSH implementations use the openssl library for entropy, which by default, doesn't use high-entropy sources. Randomness is needed to generate considerably more secure data-encryption keys. Plaintext padding, initialization vectors in encryption algorithms, and high-quality entropy eliminates the possibility that the output of the random number generator used by SSH would be known to potential attackers. |
| N/A | Force frequent session key renegotiation | The `RekeyLimit` parameter specifies how often the session key of the is renegotiated, both in terms of amount of data that may be transmitted and the time elapsed. To decrease the default limits, add or correct the following line in `/etc/ssh/sshd_config`:
    RekeyLimit 1G 1hour
| By decreasing the limit based on the amount of data and enabling time-based limit, effects of potential attacks against encryption keys are limited. | var_rekey_limit_size=1G var_rekey_limit_time=1hour
| N/A | SSH server uses strong entropy to seed | To set up SSH server to use entropy from a high-quality source, edit the `/etc/sysconfig/sshd` file. The `SSH_USE_STRONG_RNG` configuration value determines how many bytes of entropy to use, so make sure that the file contains line
    SSH_USE_STRONG_RNG=32
| SSH implementation in RHEL8 uses the openssl library, which doesn't use high-entropy sources by default. Randomness is needed to generate data-encryption keys, and as plaintext padding and initialization vectors in encryption algorithms, and high-quality entropy elliminates the possibility that the output of the random number generator used by SSH would be known to potential attackers. |
| N/A | Enforce usage of pam_wheel for su authentication | To ensure that only users who are members of the `wheel` group can run commands with altered privileges through the `su` command, make sure that the following line exists in the file `/etc/pam.d/su`:
    auth             required        pam_wheel.so use_uid
| The `su` program allows to run commands with a substitute user and group ID. It is commonly used to run commands as the root user. Limiting access to such command is considered a good security practice. |