Rules with NIST-800-53 Reference in Guide to the Secure Configuration of Oracle Linux 7

Mapping | Rule Title | Description | Rationale
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Discretionary Access Controls - fsetxattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
| The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on Kernel Module Unloading - delete_module | To capture kernel module unloading events, use following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
    -a always,exit -F arch=ARCH -S delete_module -F key=modules
Place to add the line depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the line to file `/etc/audit/audit.rules`. | The removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Discretionary Access Controls - lchown | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
| The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Delete Attempts to Files - unlink | The audit system should collect unsuccessful file deletion attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b32 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b64 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
| Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessful Creation Attempts to Files - open O_CREAT | The audit system should collect unauthorized file accesses for all users and root. The `open` syscall can be used to create new files when O_CREAT flag is specified. The following auidt rules will asure that unsuccessful attempts to create a file via `open` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
| Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record attempts to alter time through settimeofday | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
    -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules
| Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Permission Changes to Files - chmod | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S chmod -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S chmod -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S chmod -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S chmod -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - umount | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) CM-6(a) | Ensure auditd Collects File Deletion Events by User - unlink | At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S unlink -F auid>=1000 -F auid!=unset -F key=delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S unlink -F auid>=1000 -F auid!=unset -F key=delete
| Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.
AU-2(d) AU-12(c) CM-6(a) | Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly | The audit system should collect detailed unauthorized file accesses for all users and root. To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access of files via `open` syscall the audit rules collecting these events need to be in certain order. The more specific rules need to come before the less specific rules. The reason for that is that more specific rules cover a subset of events covered in the less specific rules, thus, they need to come before to not be overshadowed by less specific rules, which match a bigger set of events. Make sure that rules for unsuccessful calls of `open` syscall are in the order shown below. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), check the order of rules below in a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, check the order of rules below in `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
    -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
    -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
| The more specific rules cover a subset of events covered by the less specific rules. By ordering them from more specific to less specific, it is assured that the less specific rule will not catch events better recorded by the more specific rule.
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Discretionary Access Controls - lsetxattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
| The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Permission Changes to Files - lremovexattr | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S lremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S lremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S lremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S lremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Discretionary Access Controls - removexattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
| The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessful Access Attempts to Files - creat | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
| Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessful Access Attempts to Files - ftruncate | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S ftruncate -F exiu=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
| Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - su | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Delete Attempts to Files - unlinkat | The audit system should collect unsuccessful file deletion attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S unlinkat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b32 -S unlinkat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S unlinkat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b64 -S unlinkat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
| Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - postdrop | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record attempts to alter time through adjtimex | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
    -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules
| Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessful Access Attempts to Files - open_by_handle_at | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
| Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Attempts to Alter Time Through clock_settime | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
    -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules
| Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
IA-2 CM-6(a) | All GIDs referenced in /etc/passwd must be defined in /etc/group | Add a group to the system for each GID referenced without a corresponding group. | If a user is assigned the Group Identifier (GID) of a group not existing on the system, and a group with the Group Identifier (GID) is subsequently created, the user may have unintended rights to any files associated with the group.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Ownership Changes to Files - chown | The audit system should collect unsuccessful file ownership change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S chown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S chown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S chown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S chown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessful Access Attempts to Files - truncate | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
| Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessful Creation Attempts to Files - openat O_CREAT | The audit system should collect unauthorized file accesses for all users and root. The `openat` syscall can be used to create new files when O_CREAT flag is specified. The following auidt rules will asure that unsuccessful attempts to create a file via `openat` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
| Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - sudo | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/libexec/pt_chown -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/libexec/pt_chown -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Permission Changes to Files - fchmod | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S fchmod -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S fchmod -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchmod -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S fchmod -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on Kernel Module Loading and Unloading | To capture kernel module loading and unloading events, use following lines, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
    -a always,exit -F arch=ARCH -S init_module,finit_module,delete_module -F key=modules
The place to add the lines depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the lines to file `/etc/audit/audit.rules`. | The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessful Access Attempts to Files - openat | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
| Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Ownership Changes to Files - fchownat | The audit system should collect unsuccessful file ownership change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Any Attempts to Run chcon | At a minimum, the audit system should collect any execution attempt of the `chcon` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Permission Changes to Files - fremovexattr | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE | The audit system should collect detailed unauthorized file accesses for all users and root. The `open_by_handle_at` syscall can be used to modify files if called for write operation of with O_TRUNC_WRITE flag. The following auidt rules will asure that unsuccessful attempts to modify a file via `open_by_handle_at` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
| Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Ensure auditd Collects File Deletion Events by User | At a minimum the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=unset -F key=delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename -S renameat -F auid>=1000 -F auid!=unset -F key=delete
| Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Attempts to Alter Logon and Logout Events - lastlog | The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing logon events:
    -w /var/log/lastlog -p wa -k logins
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for unattempted manual edits of files involved in storing logon events:
    -w /var/log/lastlog -p wa -k logins
| Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
IA-2 CM-6(a) | Direct root Logins Not Allowed | To further limit access to the `root` account, administrators can disable root logins at the console by editing the `/etc/securetty` file. This file lists all devices the root user is allowed to login to. If the file does not exist at all, the root user can login through any communication device on the system, whether via the console or via a raw network interface. This is dangerous as user can login to the system as root via Telnet, which sends the password in plain text over the network. By default, Oracle Linux 7's `/etc/securetty` file only allows the root user to login at the console physically attached to the system. To prevent root from logging in, remove the contents of this file. To prevent direct root logins, remove the contents of this file by typing the following command:
    $ sudo echo > /etc/securetty
| Disabling direct root logins ensures proper accountability and multifactor authentication to privileged accounts. Users will first login, then escalate to privileged (root) access via su / sudo. This is required for FISMA Low and FISMA Moderate systems.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - at | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/at -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/at -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Discretionary Access Controls - setxattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
| The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Discretionary Access Controls - fremovexattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
| The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - mount | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Any Attempts to Run setfiles | At a minimum, the audit system should collect any execution attempt of the `setfiles` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Discretionary Access Controls - fchown | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
| The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Discretionary Access Controls - chown | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod
| The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
IA-2 AC-3 CM-6(a) | Require Authentication for Emergency Systemd Target | Emergency mode is intended as a system recovery method, providing a single user root access to the system during a failed boot sequence. By default, Emergency mode is protected by requiring a password and is set in `/usr/lib/systemd/system/emergency.service`. | This prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Permission Changes to Files - lsetxattr | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S lsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S lsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S lsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S lsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
IA-2 AC-3 CM-6(a) | Require Authentication for Single User Mode | Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. By default, no authentication is performed if single-user mode is selected. By default, single-user mode is protected by requiring a password and is set in `/usr/lib/systemd/system/rescue.service`. | This prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.
AU-2(d) AU-12(c) CM-6(a) | Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) | At a minimum the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
| Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify the System's Network Environment | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
    -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
    -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
| The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited.
AU-2(d) AU-12(c) CM-6(a) | Record Attempts to Alter Process and Session Initiation Information | The audit system already collects process information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing such process information:
    -w /var/run/utmp -p wa -k session
    -w /var/log/btmp -p wa -k session
    -w /var/log/wtmp -p wa -k session
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for attempted manual edits of files involved in storing such process information:
    -w /var/run/utmp -p wa -k session
    -w /var/log/btmp -p wa -k session
    -w /var/log/wtmp -p wa -k session
| Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Any Attempts to Run restorecon | At a minimum, the audit system should collect any execution attempt of the `restorecon` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/restorecon -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/sbin/restorecon -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Attempts to Alter Time Through stime | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d` for both 32 bit and 64 bit systems:
    -a always,exit -F arch=b32 -S stime -F key=audit_time_rules
Since the 64 bit version of the "stime" system call is not defined in the audit lookup table, the corresponding "-F arch=b64" form of this rule is not expected to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule form itself is sufficient for both 32 bit and 64 bit systems). If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file for both 32 bit and 64 bit systems:
    -a always,exit -F arch=b32 -S stime -F key=audit_time_rules
Since the 64 bit version of the "stime" system call is not defined in the audit lookup table, the corresponding "-F arch=b64" form of this rule is not expected to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule form itself is sufficient for both 32 bit and 64 bit systems). The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined system calls:
    -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules
| Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - userhelper | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on Kernel Module Loading - init_module | To capture kernel module loading events, use following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
    -a always,exit -F arch=ARCH -S init_module -F key=modules
Place to add the line depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the line to file `/etc/audit/audit.rules`. | The addition of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
AU-2(d) AU-12(c) CM-6(a) | Ensure auditd Collects File Deletion Events by User - rmdir | At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S rmdir -F auid>=1000 -F auid!=unset -F key=delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S rmdir -F auid>=1000 -F auid!=unset -F key=delete
| Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - crontab | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) CM-6(a) | Ensure auditd Collects File Deletion Events by User - unlinkat | At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S unlinkat -F auid>=1000 -F auid!=unset -F key=delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S unlinkat -F auid>=1000 -F auid!=unset -F key=delete
| Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE | The audit system should collect detailed unauthorized file accesses for all users and root. The `openat` syscall can be used to modify files if called for write operation of with O_TRUNC_WRITE flag. The following auidt rules will asure that unsuccessful attempts to modify a file via `openat` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
| Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Delete Attempts to Files - rename | The audit system should collect unsuccessful file deletion attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b32 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b64 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
| Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Attempts to Alter the localtime File | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -w /etc/localtime -p wa -k audit_time_rules
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -w /etc/localtime -p wa -k audit_time_rules
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport and should always be used. | Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Any Attempts to Run setsebool | At a minimum, the audit system should collect any execution attempt of the `setsebool` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE | The audit system should collect detailed unauthorized file accesses for all users and root. The `open` syscall can be used to modify files if called for write operation of with O_TRUNC_WRITE flag. The following auidt rules will asure that unsuccessful attempts to modify a file via `open` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
| Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Ownership Changes to Files - fchown | The audit system should collect unsuccessful file ownership change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - postqueue | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) CM-6(a) | Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly | The audit system should collect detailed unauthorized file accesses for all users and root. To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access of files via `open_by_handle_at` syscall the audit rules collecting these events need to be in certain order. The more specific rules need to come before the less specific rules. The reason for that is that more specific rules cover a subset of events covered in the less specific rules, thus, they need to come before to not be overshadowed by less specific rules, which match a bigger set of events. Make sure that rules for unsuccessful calls of `open_by_handle_at` syscall are in the order shown below. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), check the order of rules below in a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, check the order of rules below in `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
    -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
    -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
| The more specific rules cover a subset of events covered by the less specific rules. By ordering them from more specific to less specific, it is assured that the less specific rule will not catch events better recorded by the more specific rule.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Permission Changes to Files - fchmodat | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S fchmodat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S fchmodat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fchmodat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S fchmodat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Delete Attempts to Files - renameat | The audit system should collect unsuccessful file deletion attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b32 -S renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
    -a always,exit -F arch=b64 -S renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
| Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Discretionary Access Controls - fchmod | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
| The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Ownership Changes to Files - lchown | The audit system should collect unsuccessful file ownership change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S lchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S lchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S lchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S lchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Discretionary Access Controls - chmod | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod
| The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Discretionary Access Controls - fchmodat | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
| The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
IA-2 AC-6(5) IA-4(b) | Verify Only Root Has UID 0 | If any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed. If the account is associated with system commands or applications the UID should be changed to one greater than "0" but less than "1000." Otherwise assign a UID greater than "1000" that has not already been assigned. | An account has root authority if it has a UID of 0. Multiple accounts with a UID of 0 afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Attempts to Alter Logon and Logout Events - faillock | The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing logon events:
    -w /var/run/faillock -p wa -k logins
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for unattempted manual edits of files involved in storing logon events:
    -w /var/run/faillock -p wa -k logins
| Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
AU-2(d) AU-12(c) CM-6(a) | Ensure auditd Collects File Deletion Events by User - rename | At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S rename -F auid>=1000 -F auid!=unset -F key=delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S rename -F auid>=1000 -F auid!=unset -F key=delete
| Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Permission Changes to Files - removexattr | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S removexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S removexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S removexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S removexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Ensure auditd Collects File Deletion Events by User - renameat | At a minimum, the audit system should collect file deletion events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S renameat -F auid>=1000 -F auid!=unset -F key=delete
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S renameat -F auid>=1000 -F auid!=unset -F key=delete
| Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Discretionary Access Controls - lremovexattr | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
| The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Permission Changes to Files - fsetxattr | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S fsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S fsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Mandatory Access Controls | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -w /etc/selinux/ -p wa -k MAC-policy
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -w /etc/selinux/ -p wa -k MAC-policy
| The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` to capture kernel module loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S finit_module -F key=modules
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to capture kernel module loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S finit_module -F key=modules
| The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Any Attempts to Run seunshare | At a minimum, the audit system should collect any execution attempt of the `seunshare` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/seunshare -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/sbin/seunshare -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT | The audit system should collect unauthorized file accesses for all users and root. The `open_by_handle_at` syscall can be used to create new files when O_CREAT flag is specified. The following auidt rules will asure that unsuccessful attempts to create a file via `open_by_handle_at` syscall are collected. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rules below to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rules below to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
| Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on Exporting to Media (successful) | At a minimum, the audit system should collect media exportation events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 or b64 as appropriate for your system:
    -a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export
| The unauthorized exportation of data to external media could result in an information leak where classified information, Privacy Act information, and intellectual property could be lost. An audit trail should be created each time a filesystem is mounted to help identify and guard against information loss.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/pam_timestamp_check
    -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/pam_timestamp_check
    -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) CM-6(a) | Record Events that Modify the System's Discretionary Access Controls - fchownat | At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod
| The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Attempts to Alter Logon and Logout Events | The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing logon events:
    -w /var/log/tallylog -p wa -k logins
    -w /var/run/faillock -p wa -k logins
    -w /var/log/lastlog -p wa -k logins
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for unattempted manual edits of files involved in storing logon events:
    -w /var/log/tallylog -p wa -k logins
    -w /var/run/faillock -p wa -k logins
    -w /var/log/lastlog -p wa -k logins
| Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessful Access Attempts to Files - open | At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
| Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AC-2(g) AU-3 AU-10 AU-2(d) AU-12(c) AU-14(1) AC-6(9) CM-6(a) SI-4(23) | Enable auditd Service | The `auditd` service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The `auditd` service can be enabled with the following command:
    $ sudo systemctl enable auditd.service
| Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Ensuring the `auditd` service is active ensures audit records generated by the kernel are appropriately recorded. Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
AU-2(d) AU-12(c) CM-6(a) | Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly | The audit system should collect detailed unauthorized file accesses for all users and root. To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access of files via `openat` syscall the audit rules collecting these events need to be in certain order. The more specific rules need to come before the less specific rules. The reason for that is that more specific rules cover a subset of events covered in the less specific rules, thus, they need to come before to not be overshadowed by less specific rules, which match a bigger set of events. Make sure that rules for unsuccessful calls of `openat` syscall are in the order shown below. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), check the order of rules below in a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, check the order of rules below in `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
    -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create
    -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification
    -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
    -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access
| The more specific rules cover a subset of events covered by the less specific rules. By ordering them from more specific to less specific, it is assured that the less specific rule will not catch events better recorded by the more specific rule.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Attempts to Alter Logon and Logout Events - tallylog | The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing logon events:
    -w /var/log/tallylog -p wa -k logins
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for unattempted manual edits of files involved in storing logon events:
    -w /var/log/tallylog -p wa -k logins
| Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/sudoedit -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/sudoedit -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Access Events to Audit Log Directory | The audit system should collect access events to read audit log directory. The following audit rule will assure that access to audit log directory are collected.
    -a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail
If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the rule to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the rule to `/etc/audit/audit.rules` file. | Attempts to read the logs should be recorded, suspicious access to audit log files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.'
AU-2(d) AU-12(c) CM-6(a) | Record Unsuccessul Permission Changes to Files - setxattr | The audit system should collect unsuccessful file permission change attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file.
    -a always,exit -F arch=b32 -S setxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b32 -S setxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines:
    -a always,exit -F arch=b64 -S setxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
    -a always,exit -F arch=b64 -S setxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
| Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
SC-2(1) CM-6(a) | Verify that Interactive Boot is Disabled | Oracle Linux 7 systems support an "interactive boot" option that can be used to prevent services from being started. On a Oracle Linux 7 system, interactive boot can be enabled by providing a `1`, `yes`, `true`, or `on` value to the `systemd.confirm_spawn` kernel argument in `/etc/default/grub`. Remove any instance of
    systemd.confirm_spawn=(1|yes|true|on)
from the kernel arguments in that file to disable interactive boot. It is also required to change the runtime configuration, run:
    /sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"
| Using interactive boot, the console user could disable auditing, firewalls, or other services, weakening system security.
IA-2(1) IA-2(2) IA-2(3) IA-2(4) IA-2(6) IA-2(7) IA-2(11) CM-6(a) | Configure opensc Smart Card Drivers | The OpenSC smart card tool can auto-detect smart card drivers; however, setting the smart card drivers in use by your organization helps to prevent users from using unauthorized smart cards. The default smart card driver for this profile is ``default``. To configure the OpenSC driver, edit the `/etc/opensc.conf` and add the following line into the file in the `app default` block, so it will look like:
    app default {
       ...
       card_drivers = default;
    }
| Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage PKI (public key infrastructure) in order to provide and verify credentials. Configuring the smart card driver in use by your organization helps to prevent users from using unauthorized smart cards.
IA-2(1) IA-2(2) IA-2(3) IA-2(4) IA-2(6) IA-2(7) IA-2(11) CM-6(a) | Force opensc To Use Defined Smart Card Driver | The OpenSC smart card middleware can auto-detect smart card drivers; however by forcing the smart card driver in use by your organization, opensc will no longer autodetect or use other drivers unless specified. This helps to prevent users from using unauthorized smart cards. The default smart card driver for this profile is ``default``. To force the OpenSC driver, edit the `/etc/opensc.conf`. Look for a line similar to:
    # force_card_driver = customcos;
and change it to:
    force_card_driver = default;
| Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage PKI (public key infrastructure) in order to provide and verify credentials. Forcing the smart card driver in use by your organization helps to prevent users from using unauthorized smart cards.
IA-2(1) IA-2(2) IA-2(3) IA-2(4) IA-2(6) IA-2(7) IA-2(11) CM-6(a) | Configure NSS DB To Use opensc | The `opensc` module should be configured for use over the `Coolkey PKCS#11` module in the NSS database. To configure the NSS database to use the `opensc` module, run the following command:
    $ sudo pkcs11-switch opensc
| Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage PKI (public key infrastructure) in order to provide and verify credentials.
IA-2(1) IA-2(2) IA-2(3) IA-2(4) IA-2(6) IA-2(7) IA-2(11) CM-6(a) | Enable the pcscd Service | The `pcscd` service can be enabled with the following command:
    $ sudo systemctl enable pcscd.service
| Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.
IA-2(1) CM-6(a) | Configure PAM in SSSD Services | SSSD should be configured to run SSSD `pam` services. To configure SSSD to known SSH hosts, add `pam` to `services` under the `[sssd]` section in `/etc/sssd/sssd.conf`. For example:
    [sssd]
    services = sudo, autofs, pam
| Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.
IA-2(1) IA-2(2) IA-2(3) IA-2(4) IA-2(6) IA-2(7) IA-2(11) CM-6(a) | Enable Smart Card Login | To enable smart card authentication, consult the documentation at: https://docs.oracle.com/en/operating-systems/oracle-linux/7/userauth/ol7-auth.html#ol7-s4-auth | Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage PKI (public key infrastructure) in order to provide and verify credentials.
AC-2(2) AC-2(3) CM-6(a) | Assign Expiration Date to Temporary Accounts | Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts. In the event temporary or emergency accounts are required, configure the system to terminate them after a documented time period. For every temporary and emergency account, run the following command to set an expiration date on it, substituting `USER` and `YYYY-MM-DD` appropriately:
    $ sudo chage -E YYYY-MM-DD USER
`YYYY-MM-DD` indicates the documented expiration date for the account. For U.S. Government systems, the operating system must be configured to automatically terminate these types of accounts after a period of 72 hours. | If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation.
SI-2(2) | Ensure McAfee Endpoint Security for Linux (ENSL) is running | Install McAfee Endpoint Security for Linux antivirus software which is provided for DoD systems and uses signatures to search for the presence of viruses on the filesystem. | Virus scanning software can be used to detect if a system has been compromised by computer viruses, as well as to limit their spread to other systems.
SI-2(2) | Install McAfee Endpoint Security for Linux (ENSL) | Install McAfee Endpoint Security for Linux antivirus software which is provided for DoD systems and uses signatures to search for the presence of viruses on the filesystem. The `mcafeetp` package can be installed with the following command:
    $ sudo yum install mcafeetp
| Virus scanning software can be used to detect if a system has been compromised by computer viruses, as well as to limit their spread to other systems.
IA-2(3) IA-2(4) IA-2(8) IA-2(9) IA-2(11) | Enable the GNOME3 Login Smartcard Authentication | In the default graphical environment, smart card authentication can be enabled on the login screen by setting `enable-smartcard-authentication` to `true`. To enable, add or edit `enable-smartcard-authentication` to `/etc/dconf/db/gdm.d/00-security-settings`. For example:
    [org/gnome/login-screen]
    enable-smartcard-authentication=true
Once the setting has been added, add a lock to `/etc/dconf/db/gdm.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/login-screen/enable-smartcard-authentication
After the settings have been set, run `dconf update`. | Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage PKI (public key infrastructure) in order to provide and verify credentials.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/usernetctl -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/usernetctl -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow | The audit system should collect write events to /etc/shadow file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
| Creation of users through direct edition of /etc/shadow could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands | The audit system should collect information about usage of privileged commands for all users and root. To find the relevant setuid / setgid programs, run the following command for each local partition PART:
    $ sudo find PART -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null
If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d` for each setuid / setgid program on the system, replacing the SETUID_PROG_PATH part with the full path of that setuid / setgid program in the list:
    -a always,exit -F path=SETUID_PROG_PATH -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules` for each setuid / setgid program on the system, replacing the SETUID_PROG_PATH part with the full path of that setuid / setgid program in the list:
    -a always,exit -F path=SETUID_PROG_PATH -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes:
    -w /etc/group -p wa -k audit_rules_usergroup_modification
    -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes:
    -w /etc/group -p wa -k audit_rules_usergroup_modification
    -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
| In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information via openat syscall - /etc/shadow | The audit system should collect write events to /etc/shadow file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
| Creation of users through direct edition of /etc/shadow could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - passwd | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd | The audit system should collect write events to /etc/passwd file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
| Creation of users through direct edition of /etc/passwd could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Any Attempts to Run semanage | At a minimum, the audit system should collect any execution attempt of the `semanage` command for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow | The audit system should collect write events to /etc/gshadow file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
| Creation of users through direct edition of /etc/gshadow could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information via open syscall - /etc/passwd | The audit system should collect write events to /etc/passwd file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
| Creation of users through direct edition of /etc/passwd could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information via open syscall - /etc/gshadow | The audit system should collect write events to /etc/gshadow file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
| Creation of users through direct edition of /etc/gshadow could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information via openat syscall - /etc/passwd | The audit system should collect write events to /etc/passwd file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify
| Creation of users through direct edition of /etc/passwd could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group | The audit system should collect write events to /etc/group file for all group and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
| Creation of groups through direct edition of /etc/group could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information - /etc/group | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes:
    -w /etc/group -p wa -k audit_rules_usergroup_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes:
    -w /etc/group -p wa -k audit_rules_usergroup_modification
| In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information via openat syscall - /etc/group | The audit system should collect write events to /etc/group file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
| Creation of groups through direct edition of /etc/group could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/newgidmap -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/newgidmap -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information - /etc/security/opasswd | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes:
    -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes:
    -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
| In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - newgrp | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information - /etc/shadow | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes:
    -w /etc/shadow -p wa -k audit_rules_usergroup_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes:
    -w /etc/shadow -p wa -k audit_rules_usergroup_modification
| In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information via open syscall - /etc/group | The audit system should collect write events to /etc/group file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify
| Creation of groups through direct edition of /etc/group could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - chsh | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - chage | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information via open syscall - /etc/shadow | The audit system should collect write events to /etc/shadow file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify
| Creation of users through direct edition of /etc/shadow could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/bin/newuidmap -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/bin/newuidmap -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AC-2(4) AU-2(d) AU-3 AU-3.1 AU-12(a) AU-12(c) AU-12.1(ii) AU-12.1(iv) AC-6(9) CM-6(a) MA-4(1)(a) | Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd | At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset -F key=privileged
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`:
    -a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset -F key=privileged
| Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information - /etc/gshadow | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes:
    -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes:
    -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
| In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information - /etc/passwd | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes:
    -w /etc/passwd -p wa -k audit_rules_usergroup_modification
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes:
    -w /etc/passwd -p wa -k audit_rules_usergroup_modification
| In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
AC-2(4) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Record Events that Modify User/Group Information via openat syscall - /etc/gshadow | The audit system should collect write events to /etc/gshadow file for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file:
    -a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
If the system is 64 bit then also add the following line:
    -a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify
| Creation of users through direct edition of /etc/gshadow could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AC-2(5) AC-12 AC-17(a) SC-10 CM-6(a) | Set SSH Client Alive Count Max | The SSH server sends at most `ClientAliveCountMax` messages during a SSH session and waits for a response from the SSH client. The option `ClientAliveInterval` configures timeout after each `ClientAliveCountMax` message. If the SSH server does not receive a response from the client, then the connection is considered idle and terminated. For SSH earlier than v8.2, a `ClientAliveCountMax` value of `0` causes an idle timeout precisely when the `ClientAliveInterval` is set. Starting with v8.2, a value of `0` disables the timeout functionality completely. If the option is set to a number greater than `0`, then the idle session will be disconnected after `ClientAliveInterval * ClientAliveCountMax` seconds. | This ensures a user login will be terminated as soon as the `ClientAliveInterval` is reached.
SI-2(5) SI-2(c) CM-6(a) | Ensure Software Patches Installed | If the system is joined to the ULN or a yum server, run the following command to install updates:
    $ sudo yum update
If the system is not configured to use one of these sources, updates (in the form of RPM packages) can be manually downloaded from the ULN and installed using `rpm`. NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy dictates. | Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities. If the most recent security patches and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The lack of prompt attention to patching could result in a system compromise.
AC-2(5) AC-12 AC-17(a) SC-10 CM-6(a) | Set SSH Client Alive Count Max to zero | The SSH server sends at most `ClientAliveCountMax` messages during a SSH session and waits for a response from the SSH client. The option `ClientAliveInterval` configures timeout after each `ClientAliveCountMax` message. If the SSH server does not receive a response from the client, then the connection is considered idle and terminated. To ensure the SSH idle timeout occurs precisely when the `ClientAliveInterval` is set, set the `ClientAliveCountMax` to value of `0` in `/etc/ssh/sshd_config`: | This ensures a user login will be terminated as soon as the `ClientAliveInterval` is reached.
SI-2(6) CM-11(a) CM-11(b) CM-6(a) | Ensure yum Removes Previous Package Versions | `yum` should be configured to remove previous software components after new versions have been installed. To configure `yum` to remove the previous software components after updating, set the `clean_requirements_on_remove` to `1` in `/etc/yum.conf`. | Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by some adversaries.
AC-2(7)(b) AU-2(d) AU-12(c) AC-6(9) CM-6(a) | Ensure auditd Collects System Administrator Actions | At a minimum, the audit system should collect administrator actions for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -w /etc/sudoers -p wa -k actions
    -w /etc/sudoers.d/ -p wa -k actions
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file:
    -w /etc/sudoers -p wa -k actions
    -w /etc/sudoers.d/ -p wa -k actions
| The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes.
AC-3 AC-17(a) CM-7(a) CM-7(b) CM-6(a) | Disable Host-Based Authentication | SSH's cryptographic host-based authentication is more secure than `.rhosts` authentication. However, it is not recommended that hosts unilaterally trust one another, even within an organization. The default SSH configuration disables host-based authentication. The appropriate configuration is used if no value is set for `HostbasedAuthentication`. To explicitly disable host-based authentication, add or correct the following line in `/etc/ssh/sshd_config`:
    HostbasedAuthentication no
| SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.
AC-3 AC-3(3)(a) | Ensure SELinux Not Disabled in the kernel arguments | SELinux can be disabled at boot time by disabling it via a kernel argument. Remove any instances of `selinux=0` from the kernel arguments in that file to prevent SELinux from being disabled at boot. | Disabling a major host protection feature, such as SELinux, at boot time prevents it from confining system services at boot time. Further, it increases the chances that it will remain off during system operation.
AC-3 AC-3(3)(a) AU-9 SC-7(21) | Ensure SELinux State is Enforcing | The SELinux state should be set to ``enforcing`` at system boot time. In the file `/etc/selinux/config`, add or correct the following line to configure the system to boot into enforcing mode:
    SELINUX=enforcing
| Setting the SELinux state to enforcing ensures SELinux is able to confine potentially compromised processes to the security policy, which is designed to prevent them from causing damage to the system or further elevating their privileges.
AC-3 AC-3.1 AC-3 | Set the UEFI Boot Loader Password - systems prior to version 7.2 | The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. Since plaintext passwords are a security risk, generate a hash for the password by running the following command:
    # grub2-mkpasswd-pbkdf2
When prompted, enter the password that was selected. Using the hash from the output, modify the `/etc/grub.d/40_custom` file with the following content:
    set superusers="root"
    password_pbkdf2 boot grub.pbkdf2.sha512.VeryLongString
Once the superuser password has been added, update the `grub.cfg` file by running:
    grub2-mkconfig -o /boot/grub2/grub.cfg
| Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.
AC-3 AC-3(3)(a) AU-9 SC-7(21) | Configure SELinux Policy | The SELinux `targeted` policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct the following line in `/etc/selinux/config`:
    SELINUXTYPE=targeted
Other policies, such as `mls`, provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases. | Setting the SELinux policy to `targeted` or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. Note: During the development or debugging of SELinux modules, it is common to temporarily place non-production systems in `permissive` mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to ``.
AC-3 AC-3.1 AC-3 | Set Boot Loader Password in grub2 - systems prior to version 7.2 | The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. Since plaintext passwords are a security risk, generate an encrypted grub2 password for the grub superusers with the following command:
    $ grub2-mkpasswd-pbkdf2
When prompted, enter the password that was selected. Using the hash from the output, modify the `/etc/grub.d/40_custom` file with the following content:
    set superusers="root"
    password_pbkdf2 root grub.pbkdf2.sha512.VeryLongString
Once the superuser password has been added, update the `grub.cfg` file by running:
    grub2-mkconfig -o /boot/grub2/grub.cfg
| Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.
AC-3 CM-6(a) | Limit Users' SSH Access | By default, the SSH configuration allows any user with an account to access the system. In order to specify the users that are allowed to login via SSH and deny all other users, add or correct the following line in the `/etc/ssh/sshd_config` file:
    AllowUsers USER1 USER2
Where `USER1` and `USER2` are valid user names. | Specifying which accounts are allowed SSH access into the system reduces the possibility of unauthorized access to the system.
AC-3 AC-3(3)(a) | Ensure SELinux Not Disabled in /etc/default/grub | SELinux can be disabled at boot time by an argument in `/etc/default/grub`. Remove any instances of `selinux=0` from the kernel arguments in that file to prevent SELinux from being disabled at boot. | Disabling a major host protection feature, such as SELinux, at boot time prevents it from confining system services at boot time. Further, it increases the chances that it will remain off during system operation.
AC-3(4) AC-6(10) | Confine SELinux Users To Roles That Conform To Least Privilege | Configure the operating system to confine SELinux users to roles that conform to least privilege. Use the following command to map the "staff_u" SELinux user to the "staff_r" and "sysadm_r" roles:
    $ sudo semanage user -m staff_u -R staff_r -R sysadm_r
Use the following command to map the "user_u" SELinux user to the "user_r" role:
    $ sudo semanage -m user_u -R user_r
| Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.
AC-3(4) AC-6(10) | Elevate The SELinux Context When An Administrator Calls The Sudo Command | Configure the operating system to elevate the SELinux context when an administrator calls the sudo command. Edit a file in the /etc/sudoers.d directory with the following command:
    sudo visudo -f /etc/sudoers.d/CUSTOM_FILE
Use the following example to build the CUSTOM_FILE in the /etc/sudoers.d directory to allow any administrator belonging to a designated sudoers admin group to elevate their SELinux context with the use of the sudo command:
    %wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL
| Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.
CA-3(5) CM-7(b) SC-7(23) CM-6(a) | Set Default iptables Policy for Incoming Packets | To set the default policy to DROP (instead of ACCEPT) for the built-in INPUT chain which processes incoming packets, add or correct the following line in `/etc/sysconfig/iptables`:
    :INPUT DROP [0:0]
| In `iptables` the default policy is applied only after all the applicable rules in the table are examined for a match. Setting the default policy to `DROP` implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted.
CA-3(5) CM-7(b) SC-7(23) CM-6(a) | Set Default firewalld Zone for Incoming Packets | To set the default zone to `drop` for the built-in default zone which processes incoming IPv4 and IPv6 packets, modify the following line in `/etc/firewalld/firewalld.conf` to be:
    DefaultZone=drop
| In `firewalld` the default zone is applied only after all the applicable rules in the table are examined for a match. Setting the default zone to `drop` implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted.
CA-3(5) CM-7(b) SC-7(23) CM-6(a) | Set Default iptables Policy for Forwarded Packets | To set the default policy to DROP (instead of ACCEPT) for the built-in FORWARD chain which processes packets that will be forwarded from one interface to another, add or correct the following line in `/etc/sysconfig/iptables`:
    :FORWARD DROP [0:0]
| In `iptables`, the default policy is applied only after all the applicable rules in the table are examined for a match. Setting the default policy to `DROP` implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted.
AC-4 CM-7(b) CA-3(5) SC-7(21) CM-6(a) | Verify ip6tables Enabled if Using IPv6 | The `ip6tables` service can be enabled with the following command:
    $ sudo systemctl enable ip6tables.service
| The `ip6tables` service provides the system's host-based firewalling capability for IPv6 and ICMPv6.
AC-4 CM-7(a) CM-7(b) CM-6(a) | Disable Network Router Discovery Daemon (rdisc) | The `rdisc` service implements the client side of the ICMP Internet Router Discovery Protocol (IRDP), which allows discovery of routers on the local subnet. If a router is discovered then the local routing table is updated with a corresponding default route. By default this daemon is disabled. The `rdisc` service can be disabled with the following command:
    $ sudo systemctl mask --now rdisc.service
| General-purpose systems typically have their network and routing information configured statically by a system administrator. Workstations or some special-purpose systems often use DHCP (instead of IRDP) to retrieve dynamic network configuration information.
AC-4 CM-7(b) CA-3(5) SC-7(21) CM-6(a) | Verify firewalld Enabled | The `firewalld` service can be enabled with the following command:
    $ sudo systemctl enable firewalld.service
| Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols.
AC-4 CM-7(b) CA-3(5) SC-7(21) CM-6(a) | Verify iptables Enabled | The `iptables` service can be enabled with the following command:
    $ sudo systemctl enable iptables.service
| The `iptables` service provides the system's host-based firewalling capability for IPv4 and ICMP.
IA-4(e) AC-2(3) CM-6(a) | Set Account Expiration Following Inactivity | To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct the following line in `/etc/default/useradd`:
    INACTIVE=35
If a password is currently on the verge of expiration, then ``35`` day(s) remain(s) until the account is automatically disabled. However, if the password will not expire for another 60 days, then 60 days plus ``35`` day(s) could elapse until the account would be automatically disabled. See the `useradd` man page for more information. | Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials.
AC-4 CM-7(b) CA-3(5) SC-7(21) CM-6(a) | Set Default ip6tables Policy for Incoming Packets | To set the default policy to DROP (instead of ACCEPT) for the built-in INPUT chain which processes incoming packets, add or correct the following line in `/etc/sysconfig/ip6tables`:
    :INPUT DROP [0:0]
If changes were required, reload the ip6tables rules:
    $ sudo service ip6tables reload
| In `ip6tables`, the default policy is applied only after all the applicable rules in the table are examined for a match. Setting the default policy to `DROP` implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted.
AC-4 CM-7(b) CA-3(5) SC-7(21) CM-6(a) | Configure the Firewalld Ports | Configure the `firewalld` ports to allow approved services to have access to the system. To configure `firewalld` to open ports, run the following command:
    $ sudo firewall-cmd --permanent --add-port=port_number/tcp
or
    $ sudo firewall-cmd --permanent --add-port=service_name
Run the command list above for each of the ports listed below: To configure `firewalld` to allow access, run the following command(s): `firewall-cmd --permanent --add-service=ssh` | In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems. Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component. To support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.
AU-4(1) | Ensure Rsyslog Encrypts Off-Loaded Audit Records | Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. Couple this utility with `gnutls` (which is a secure communications library implementing the SSL, TLS and DTLS protocols), and you have a method to securely encrypt and off-load auditing. When using `rsyslogd` to off-load logs off a encrpytion system must be used. | The audit records generated by Rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Audit records should be protected from unauthorized access.
AU-4(1) CM-6(a) | Configure auditd to use audispd's syslog plugin | To configure the `auditd` service to use the `syslog` plug-in of the `audispd` audit event multiplexor, set the `active` line in `/etc/audisp/plugins.d/syslog.conf` to `yes`. Restart the `auditd` service:
    $ sudo service auditd restart
| The auditd service does not include the ability to send audit records to a centralized server for management directly. It does, however, include a plug-in for audit event multiplexor (audispd) to pass audit records to the local syslog server
AU-4(1) | Ensure Rsyslog Encrypts Off-Loaded Audit Records | Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. Couple this utility with `gnutls` (which is a secure communications library implementing the SSL, TLS and DTLS protocols), and you have a method to securely encrypt and off-load auditing. When using `rsyslogd` to off-load logs off a encrpytion system must be used. | The audit records generated by Rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Audit records should be protected from unauthorized access.
AU-4(1) | Ensure Rsyslog Authenticates Off-Loaded Audit Records | Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. Couple this utility with `gnutls` (which is a secure communications library implementing the SSL, TLS and DTLS protocols), and you have a method to securely encrypt and off-load auditing. When using `rsyslogd` to off-load logs the remote system must be authenticated. | The audit records generated by Rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Audit records should be protected from unauthorized access.
AU-4(1) | Appropriate Action Must be Setup When the Internal Audit Event Queue is Full | The audit system should have an action setup in the event the internal event queue becomes full. To setup an overflow action edit `/etc/audisp/audispd.conf`. Set `overflow_action` to one of the following values: `syslog`, `single`, `halt`. | The audit system should have an action setup in the event the internal event queue becomes full so that no data is lost.
IA-5(c) IA-5(1)(a) CM-6(a) IA-5(4) | Ensure PAM Enforces Password Requirements - Minimum Length | The pam_pwquality module's `minlen` parameter controls requirements for minimum characters required in a password. Add `minlen=`15`` after pam_pwquality to set minimum password length requirements. | The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromose the password.
SC-5 | Configure Kernel to Rate Limit Sending of Duplicate TCP Acknowledgments | Make sure that the system is configured to limit the maximal rate for sending duplicate acknowledgments in response to incoming TCP packets that are for an existing connection but that are invalid due to any of these reasons: (a) out-of-window sequence number, (b) out-of-window acknowledgment number, or (c) PAWS (Protection Against Wrapped Sequence numbers) check failure This measure protects against or limits effects of DoS attacks against the system. Set the system to implement rate-limiting measures by adding the following line to `/etc/sysctl.conf` or a configuration file in the `/etc/sysctl.d/` directory (or modify the line to have the required value):
    net.ipv4.tcp_invalid_ratelimit = 500
Issue the following command to make the changes take effect:
    # sysctl --system
| Denial of Service (DoS) is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. This can help mitigate simple “ack loop” DoS attacks, wherein a buggy or malicious middlebox or man-in-the-middle can rewrite TCP header fields in manner that causes each endpoint to think that the other is sending invalid TCP segments, thus causing each side to send an unterminating stream of duplicate acknowledgments for invalid segments.
IA-5(f) IA-5(1)(e) | Limit Password Reuse: password-auth | Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_pwhistory` PAM modules. In the file `/etc/pam.d/password-auth`, make sure the parameter `remember` is present, and that the value for the `remember` parameter is `5` or greater. For example:
    password requisite pam_pwhistory.so ...existing_options... remember=5 use_authtok
The DoD STIG requirement is 5 passwords. | Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.
- IA-5(f) IA-5(1)(e) | Limit Password Reuse | Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_unix` or `pam_pwhistory` PAM modules. In the file `/etc/pam.d/system-auth`, append `remember=`5`` to the line which refers to the `pam_unix.so` or `pam_pwhistory.so`module, as shown below: for the `pam_unix.so` case:
      password sufficient pam_unix.so ...existing_options... remember=5
- for the `pam_pwhistory.so` case:
      password requisite pam_pwhistory.so ...existing_options... remember=5
The DoD STIG requirement is 5 passwords. | Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.
IA-5(c) CM-6(a) IA-5(4) | Set Password Maximum Consecutive Repeating Characters | The pam_pwquality module's `maxrepeat` parameter controls requirements for consecutive repeating characters. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters. Modify the `maxrepeat` setting in `/etc/security/pwquality.conf` to equal `3` to prevent a run of (`3` + 1) or more identical characters. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks.
IA-5(f) IA-5(1)(d) CM-6(a) | Set Existing Passwords Maximum Age | Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction by running the following command:
    $ sudo chage -M 60 USER
| Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.
AU-5(b) AU-5(2) AU-5(1) AU-5(4) CM-6(a) | Configure auditd space_left Action on Low Disk Space | The `auditd` service can be configured to take an action when disk space starts to run low. Edit the file `/etc/audit/auditd.conf`. Modify the following line, substituting ACTION appropriately:
    space_left_action = ACTION
Possible values for ACTION are described in the `auditd.conf` man page. These include: `syslog` `email` `exec` `suspend` `single` `halt` Set this to `email` (instead of the default, which is `suspend`) as it is more likely to get prompt attention. Acceptable values also include `suspend`, `single`, and `halt`. | Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.
IA-5(c) IA-5(1)(c) CM-6(a) | Set Password Hashing Algorithm in /etc/libuser.conf | In `/etc/libuser.conf`, add or correct the following line in its `[defaults]` section to ensure the system will use the SHA-512 algorithm for password hashing:
    crypt_style = sha512
| Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kepy in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the `crypt_style` configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
IA-5(c) IA-5(1)(c) CM-6(a) | Set PAM's Password Hashing Algorithm | The PAM system service can be configured to only store encrypted representations of passwords. In `/etc/pam.d/system-auth`, the `password` section of the file controls which PAM modules execute during a password change. Set the `pam_unix.so` module in the `password` section to include the argument `sha512`, as shown below:
    password    sufficient    pam_unix.so sha512 other arguments...
This will help ensure when local users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. This is the default. | Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kepy in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the `crypt_style` configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
IA-5(c) IA-5(1)(c) CM-6(a) | Set Password Hashing Algorithm in /etc/login.defs | In `/etc/login.defs`, add or correct the following line to ensure the system will use SHA-512 as the hashing algorithm:
    ENCRYPT_METHOD SHA512
| Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using a stronger hashing algorithm makes password cracking attacks more difficult.
AU-5(b) AU-5(2) AU-5(1) AU-5(4) CM-6(a) | Configure auditd admin_space_left Action on Low Disk Space | The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting ACTION appropriately:
    admin_space_left_action = ACTION
Set this value to `single` to cause the system to switch to single user mode for corrective action. Acceptable values also include `suspend` and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the `auditd.conf` man page. | Administrators should be made aware of an inability to record audit records. If a separate partition or logical volume of adequate size is used, running low on space for audit records should never occur.
IA-5(c) IA-5(1)(a) CM-6(a) IA-5(4) | Ensure PAM Enforces Password Requirements - Minimum Special Characters | The pam_pwquality module's `ocredit=` parameter controls requirements for usage of special (or "other") characters in a password. When set to a negative number, any password will be required to contain that many special characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each special character. Modify the `ocredit` setting in `/etc/security/pwquality.conf` to equal `-1` to require use of a special character in passwords. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possble combinations that need to be tested before the password is compromised. Requiring a minimum number of special characters makes password guessing attacks more difficult by ensuring a larger search space.
IA-5(c) IA-5(1)(a) CM-6(a) IA-5(4) | Ensure PAM Enforces Password Requirements - Minimum Different Categories | The pam_pwquality module's `minclass` parameter controls requirements for usage of different character classes, or types, of character that must exist in a password before it is considered valid. For example, setting this value to three (3) requires that any password must have characters from at least three different categories in order to be approved. The default value is zero (0), meaning there are no required classes. There are four categories available:
    * Upper-case characters
    * Lower-case characters
    * Digits
    * Special characters (for example, punctuation)
Modify the `minclass` setting in `/etc/security/pwquality.conf` entry to require `3` differing categories of characters when changing passwords. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of character categories makes password guessing attacks more difficult by ensuring a larger search space.
AU-5(b) AU-5(2) AU-5(1) AU-5(4) CM-6(a) | Configure auditd max_log_file_action Upon Reaching Maximum Log Size | The default action to take when the logs reach their maximum size is to rotate the log files, discarding the oldest one. To configure the action taken by `auditd`, add or correct the line in `/etc/audit/auditd.conf`:
    max_log_file_action = ACTION
Possible values for ACTION are described in the `auditd.conf` man page. These include: `ignore` `syslog` `suspend` `rotate` `keep_logs` Set the `ACTION` to `rotate` to ensure log rotation occurs. This is the default. The setting is case-insensitive. | Automatically rotating logs (by setting this to `rotate`) minimizes the chances of the system unexpectedly running out of disk space by being overwhelmed with log data. However, for systems that must never discard log data, or which use external processes to transfer it and reclaim space, `keep_logs` can be employed.
AU-5(b) AU-5(2) AU-5(1) AU-5(4) CM-6(a) | Configure audispd's Plugin disk_full_action When Disk Is Full | Configure the action the operating system takes if the disk the audit records are written to becomes full. Edit the file `/etc/audisp/audisp-remote.conf`. Add or modify the following line, substituting ACTION appropriately:
    disk_full_action = ACTION
Set this value to `single` to cause the system to switch to single user mode for corrective action. Acceptable values also include `syslog` and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. | Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.
IA-5(f) IA-5(1)(d) CM-6(a) | Set Password Minimum Age | To specify password minimum age for new accounts, edit the file `/etc/login.defs` and add or correct the following line:
    PASS_MIN_DAYS 7
A value of 1 day is considered sufficient for many environments. The DoD requirement is 1. The profile requirement is ``7``. | Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse. Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement.
IA-5(h) CM-6(a) | Verify All Account Password Hashes are Shadowed | If any password hashes are stored in `/etc/passwd` (in the second field, instead of an `x` or `*`), the cause of this misconfiguration should be investigated. The account should have its password reset and the hash should be properly stored, or the account should be deleted entirely. | The hashes for all user account passwords should be stored in the file `/etc/shadow` and never in `/etc/passwd`, which is readable by all users.
IA-5(f) IA-5(1)(d) CM-6(a) | Set Password Maximum Age | To specify password maximum age for new accounts, edit the file `/etc/login.defs` and add or correct the following line:
    PASS_MAX_DAYS 60
A value of 180 days is sufficient for many environments. The DoD requirement is 60. The profile requirement is ``60``. | Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised. Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.
CM-5 CM-5(6) CM-5(6).1 | Verify that Shared Library Directories Have Restrictive Permissions | System-wide shared library directories, which contain are linked to executables during process load time or run time, are stored in the following directories by default:
    /lib
    /lib64
    /usr/lib
    /usr/lib64
Kernel modules, which can be added to the kernel during runtime, are stored in `/lib/modules`. All sub-directories in these directories should not be group-writable or world-writable. If any file in these directories is found to be group-writable or world-writable, correct its permission with the following command:
    $ sudo chmod go-w DIR
| If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
IA-5(h) IA-5(1)(c) CM-6(a) IA-5(7) | Verify No netrc Files Exist | The `.netrc` files contain login information used to auto-login into FTP servers and reside in the user's home directory. These files may contain unencrypted passwords to remote FTP servers making them susceptible to access by unauthorized users and should not be used. Any `.netrc` files should be removed. | Unencrypted passwords for remote FTP servers may be stored in `.netrc` files.
SC-5 SC-5(1) SC-5(2) SC-5(3)(a) CM-6(a) | Configure firewalld To Rate Limit Connections | Create a direct firewall rule to protect against DoS attacks with the following command:
    $ sudo firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m limit --limit 25/minute --limit-burst 100  -j INPUT_ZONES
| DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. This requirement addresses the configuration of the operating system to mitigate the impact of DoS attacks that have occurred or are ongoing on system availability. For each system, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or establishing memory partitions). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.
AU-5(b) AU-5(2) AU-5(1) AU-5(4) CM-6(a) | Configure auditd Disk Full Action when Disk Space Is Full | The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting ACTION appropriately:
    disk_full_action = ACTION
Set this value to `single` to cause the system to switch to single-user mode for corrective action. Acceptable values also include `syslog`, `exec`, `single`, and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the `auditd.conf` man page. | Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.
IA-5(f) IA-5(1)(d) CM-6(a) | Set Password Warning Age | To specify how many days prior to password expiration that a warning will be issued to users, edit the file `/etc/login.defs` and add or correct the following line:
    PASS_WARN_AGE 7
The DoD requirement is 7. The profile requirement is ``7``. | Setting the password warning age enables users to make the change at a practical time.
IA-5(c) IA-5(1)(a) CM-6(a) IA-5(4) | Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class | The pam_pwquality module's `maxclassrepeat` parameter controls requirements for consecutive repeating characters from the same character class. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters from the same character class. Modify the `maxclassrepeat` setting in `/etc/security/pwquality.conf` to equal `4` to prevent a run of (`4` + 1) or more identical characters. | Use of a complex password helps to increase the time and resources required to comrpomise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex a password, the greater the number of possible combinations that need to be tested before the password is compromised.
AU-5(b) SC-24 CM-6(a) | Shutdown System When Auditing Failures Occur | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`:
    -f 2
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to the top of the `/etc/audit/audit.rules` file:
    -f 2
| It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.
AU-5(b) AU-5(2) AU-5(1) AU-5(4) CM-6(a) | Configure auditd space_left on Low Disk Space | The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting SIZE_in_MB appropriately:
    space_left = SIZE_in_MB
Set this value to the appropriate size in Megabytes cause the system to notify the user of an issue. | Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.
IA-5(f) IA-5(1)(d) CM-6(a) | Set Existing Passwords Minimum Age | Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime by running the following command:
    $ sudo chage -m 1 USER
| Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.
IA-5(c) IA-5(1)(a) CM-6(a) IA-5(4) | Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters | The pam_pwquality module's `ucredit=` parameter controls requirements for usage of uppercase letters in a password. When set to a negative number, any password will be required to contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each uppercase character. Modify the `ucredit` setting in `/etc/security/pwquality.conf` to require the use of an uppercase character in passwords. | Use of a complex password helps to increase the time and resources reuiqred to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.
IA-5(c) IA-5(1)(a) CM-6(a) IA-5(4) | Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters | The pam_pwquality module's `lcredit` parameter controls requirements for usage of lowercase letters in a password. When set to a negative number, any password will be required to contain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each lowercase character. Modify the `lcredit` setting in `/etc/security/pwquality.conf` to require the use of a lowercase character in passwords. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possble combinations that need to be tested before the password is compromised. Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space.
AU-5(b) AU-5(2) AU-5(1) AU-5(4) CM-6(a) | Configure audispd's Plugin network_failure_action On Network Failure | Configure the action the operating system takes if there is an error sending audit records to a remote system. Edit the file `/etc/audisp/audisp-remote.conf`. Add or modify the following line, substituting ACTION appropriately:
    network_failure_action = ACTION
Set this value to `single` to cause the system to switch to single user mode for corrective action. Acceptable values also include `syslog` and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. This profile configures the action to be ``single``. | Taking appropriate action when there is an error sending audit records to a remote system will minimize the possibility of losing audit records.
IA-5(f) IA-5(1)(e) | Limit Password Reuse: system-auth | Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_pwhistory` PAM modules. In the file `/etc/pam.d/system-auth`, make sure the parameter `remember` is present, and that the value for the `remember` parameter is `5` or greater. For example:
    password requisite pam_pwhistory.so ...existing_options... remember=5 use_authtok
The DoD STIG requirement is 5 passwords. | Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.
AU-5(b) AU-5(2) AU-5(1) AU-5(4) CM-6(a) | Configure auditd Disk Error Action on Disk Error | The `auditd` service can be configured to take an action when there is a disk error. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting ACTION appropriately:
    disk_error_action = ACTION
Set this value to `single` to cause the system to switch to single-user mode for corrective action. Acceptable values also include `syslog`, `exec`, `single`, and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the `auditd.conf` man page. | Taking appropriate action in case of disk errors will minimize the possibility of losing audit records.
IA-5(e) | Ensure Default SNMP Password Is Not Used | Edit `/etc/snmp/snmpd.conf`, remove or change the default community strings of `public` and `private`. This profile configures new read-only community string to ``changemero`` and read-write community string to ``changemerw``. Once the default community strings have been changed, restart the SNMP service:
    $ sudo service snmpd restart
| Whether active or not, default simple network management protocol (SNMP) community strings must be changed to maintain security. If the service is running with the default authenticators, then anyone can gather data about the system and the network and use the information to potentially compromise the integrity of the system and network(s).
IA-5(c) IA-5(1)(a) CM-6(a) IA-5(4) | Ensure PAM Enforces Password Requirements - Minimum Digit Characters | The pam_pwquality module's `dcredit` parameter controls requirements for usage of digits in a password. When set to a negative number, any password will be required to contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional length credit for each digit. Modify the `dcredit` setting in `/etc/security/pwquality.conf` to require the use of a digit in passwords. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring digits makes password guessing attacks more difficult by ensuring a larger search space.
IA-5(c) IA-5(1)(b) CM-6(a) IA-5(4) | Ensure PAM Enforces Password Requirements - Minimum Different Characters | The pam_pwquality module's `difok` parameter sets the number of characters in a password that must not be present in and old password during a password change. Modify the `difok` setting in `/etc/security/pwquality.conf` to equal `8` to require differing characters when changing passwords. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute–force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note that passwords which are changed on compromised systems will still be compromised, however.
IA-5(f) IA-5(1)(a) CM-6(a) | Set Password Minimum Length in login.defs | To specify password length requirements for new accounts, edit the file `/etc/login.defs` and add or correct the following line:
    PASS_MIN_LEN 15
The DoD requirement is `15`. The FISMA requirement is `12`. The profile requirement is ``15``. If a program consults `/etc/login.defs` and also another PAM module (such as `pam_pwquality`) during a password change operation, then the most restrictive must be satisfied. See PAM section for more information about enforcing password quality requirements. | Requiring a minimum password length makes password cracking attacks more difficult by ensuring a larger search space. However, any security benefit from an onerous requirement must be carefully weighed against usability problems, support costs, or counterproductive behavior that may result.
IA-5(1)(a) IA-5(c) CM-6(a) | Prevent Login to Accounts With Empty Password | If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. Remove any instances of the `nullok` in `/etc/pam.d/system-auth` to prevent logins with empty passwords. | If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
IA-5(1) AU-5(a) AU-5(2) CM-6(a) | Configure auditd mail_acct Action on Low Disk Space | The `auditd` service can be configured to send email to a designated account in certain situations. Add or correct the following line in `/etc/audit/auditd.conf` to ensure that administrators are notified via email for those situations:
    action_mail_acct = root
| Email sent to the root account is typically aliased to the administrators of the system, who can take appropriate action.
CM-5(1) AU-7(a) AU-7(b) AU-8(b) AU-12(3) AC-6(9) | Record Events When Privileged Executables Are Run | Verify the system generates an audit record when privileged functions are executed.
    # grep -iw execve /etc/audit/audit.rules
    -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid
    -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid
    -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid
    -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid
If both the "b32" and "b64" audit rules for "SUID" files are not defined, this is a finding. If both the "b32" and "b64" audit rules for "SGID" files are not defined, this is a finding. | Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.
CM-5(3) SI-7 SC-12 SC-12(3) CM-6(a) SA-12 SA-12(10) CM-11(a) CM-11(b) | Ensure gpgcheck Enabled In Main yum Configuration | The `gpgcheck` option controls whether RPM packages' signatures are always checked prior to installation. To configure yum to check package signatures before installing them, ensure the following line appears in `/etc/yum.conf` in the `[main]` section:
    gpgcheck=1
| Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA).
CM-5(3) SI-7 SC-12 SC-12(3) CM-6(a) CM-11(a) CM-11(b) | Ensure Oracle Linux GPG Key Installed | To ensure the system can cryptographically verify base software packages come from Oracle (and to connect to the Unbreakable Linux Network to receive them), the Oracle GPG key must properly be installed. To install the Oracle GPG key, run:
    $ sudo uln_register
If the system is not connected to the Internet, then install the Oracle GPG key from trusted media such as the Oracle installation CD-ROM or DVD. Assuming the disc is mounted in `/media/cdrom`, use the following command as the root user to import it into the keyring:
    $ sudo rpm --import /media/cdrom/RPM-GPG-KEY-oracle
Alternatively, the key may be pre-loaded during the Oracle installation. In such cases, the key can be installed by running the following command:
    sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
| Changes to software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. The Oracle GPG key is necessary to cryptographically verify packages are from Oracle.
CM-5(3) SI-7 SC-12 SC-12(3) CM-6(a) SA-12 SA-12(10) CM-11(a) CM-11(b) | Ensure gpgcheck Enabled for All yum Package Repositories | To ensure signature checking is not disabled for any repos, remove any lines from files in `/etc/yum.repos.d` of the form:
    gpgcheck=0
| Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA)."
CM-5(3) SI-7 SC-12 SC-12(3) CM-6(a) SA-12 SA-12(10) CM-11(a) CM-11(b) | Ensure gpgcheck Enabled for Repository Metadata | Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components of local packages without verification of the repository metadata. Check that `yum` verifies the repository metadata prior to install with the following command. This should be configured by setting `repo_gpgcheck` to `1` in `/etc/yum.conf`. | Changes to any software components can have significant effects to the overall security of the operating system. This requirement ensures the software has not been tampered and has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. NOTE: For U.S. Military systems, this requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved Certificate Authority.
CM-5(6) CM-5(6).1 CM-6(a) AC-6(1) | Verify that Shared Library Files Have Root Ownership | System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default:
    /lib
    /lib64
    /usr/lib
    /usr/lib64
Kernel modules, which can be added to the kernel during runtime, are also stored in `/lib/modules`. All files in these directories should be owned by the `root` user. If the directory, or any file in these directories, is found to be owned by a user other than root correct its ownership with the following command:
    $ sudo chown root FILE
| Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Proper ownership is necessary to protect the integrity of the system.
CM-5(6) CM-5(6).1 | Verify that Shared Library Directories Have Root Ownership | System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default:
    /lib
    /lib64
    /usr/lib
    /usr/lib64
Kernel modules, which can be added to the kernel during runtime, are also stored in `/lib/modules`. All files in these directories should be owned by the `root` user. If the directories, is found to be owned by a user other than root correct its ownership with the following command:
    $ sudo chown root DIR
| Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Proper ownership of library directories is necessary to protect the integrity of the system.
CM-5(6) CM-5(6).1 CM-6(a) AC-6(1) | Verify that System Executables Have Root Ownership | System executables are stored in the following directories by default:
    /bin
    /sbin
    /usr/bin
    /usr/libexec
    /usr/local/bin
    /usr/local/sbin
    /usr/sbin
All files in these directories should be owned by the `root` user. If any file FILE in these directories is found to be owned by a user other than root, correct its ownership with the following command:
    $ sudo chown root FILE
| System binaries are executed by privileged users as well as system services, and restrictive permissions are necessary to ensure that their execution of these programs cannot be co-opted.
CM-5(6) CM-5(6).1 CM-6(a) AC-6(1) | Verify that System Executables Have Restrictive Permissions | System executables are stored in the following directories by default:
    /bin
    /sbin
    /usr/bin
    /usr/libexec
    /usr/local/bin
    /usr/local/sbin
    /usr/sbin
All files in these directories should not be group-writable or world-writable. If any file FILE in these directories is found to be group-writable or world-writable, correct its permission with the following command:
    $ sudo chmod go-w FILE
| System binaries are executed by privileged users, as well as system services, and restrictive permissions are necessary to ensure execution of these programs cannot be co-opted.
CM-6(a) AC-6(1) | Verify Group Who Owns /etc/cron.allow file | If `/etc/cron.allow` exists, it must be group-owned by `root`. To properly set the group owner of `/etc/cron.allow`, run the command:
    $ sudo chgrp root /etc/cron.allow
| If the owner of the cron.allow file is not set to root, the possibility exists for an unauthorized user to view or edit sensitive information.
CM-6(a) | Install the Policy Auditor (PA) Module | Install the Policy Auditor (PA) Module. | Without a host-based intrusion detection tool, there is no system-level defense when an intruder gains access to a system or network. Additionally, a host-based intrusion prevention tool can provide methods to immediately lock out detected intrusion attempts.
CM-6(a) AC-6(1) | Verify /boot/grub2/grub.cfg Permissions | File permissions for `/boot/grub2/grub.cfg` should be set to 600. To properly set the permissions of `/boot/grub2/grub.cfg`, run the command:
    $ sudo chmod 600 /boot/grub2/grub.cfg
| Proper permissions ensure that only the root user can modify important boot parameters.
CM-6(a) | Install PAE Kernel on Supported 32-bit x86 Systems | Systems that are using the 64-bit x86 kernel package do not need to install the kernel-PAE package because the 64-bit x86 kernel already includes this support. However, if the system is 32-bit and also supports the PAE and NX features as determined in the previous section, the kernel-PAE package should be installed to enable XD or NX support. The `kernel-PAE` package can be installed with the following command:
    $ sudo yum install kernel-PAE
The installation process should also have configured the bootloader to load the new kernel at boot. Verify this after reboot and modify `/etc/default/grub` if necessary. | On 32-bit systems that support the XD or NX bit, the vendor-supplied PAE kernel is required to enable either Execute Disable (XD) or No Execute (NX) support.
CM-6(a) AC-6(1) | Verify Group Who Owns gshadow File | To properly set the group owner of `/etc/gshadow`, run the command:
    $ sudo chgrp root /etc/gshadow
| The `/etc/gshadow` file contains group password hashes. Protection of this file is critical for system security.
AC-6 AC-6(1) CM6(a) | Mount Remote Filesystems with nosuid | Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of any NFS mounts. | NFS mounts should not present suid binaries to users. Only vendor-supplied suid executables should be installed to their default location on the local filesystem.
CM-6(a) AC-6(1) CM-6(a) | Disable Ctrl-Alt-Del Burst Action | By default, `SystemD` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed Ctrl-Alt-Delete more than 7 times in 2 seconds. To configure the system to ignore the `CtrlAltDelBurstAction` setting, add or modify the following to `/etc/systemd/system.conf`:
    CtrlAltDelBurstAction=none
| A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
CM-6(a) | Install firewalld Package | The `firewalld` package can be installed with the following command:
    $ sudo yum install firewalld
| The firewalld package should be installed to provide access control methods.
CM-6(a) AC-6(1) | Verify /boot/grub2/grub.cfg Group Ownership | The file `/boot/grub2/grub.cfg` should be group-owned by the `root` group to prevent destruction or modification of the file. To properly set the group owner of `/boot/grub2/grub.cfg`, run the command:
    $ sudo chgrp root /boot/grub2/grub.cfg
| The `root` group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway.
CM-6(a) AU-4(1) | Enable syslog-ng Service | The `syslog-ng` service (in replacement of rsyslog) provides syslog-style logging by default on Debian. The `syslog-ng` service can be enabled with the following command:
    $ sudo systemctl enable syslog-ng.service
| The `syslog-ng` service must be running in order to provide logging services, which are essential to system administration.
CM-6(a) AC-11(a) | Enable GNOME3 Screensaver Idle Activation | To activate the screensaver in the GNOME3 desktop after a period of inactivity, add or set `idle-activation-enabled` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/screensaver]
    idle-activation-enabled=true
Once the setting has been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/screensaver/idle-activation-enabled
After the settings have been set, run `dconf update`. | A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the session lock. Enabling idle activation of the screensaver ensures the screensaver will be activated after the idle delay. Applications requiring continuous, real-time screen display (such as network management products) require the login session does not have administrator rights and the display station is located in a controlled-access area.
CM-6(a) AC-6(1) | Ensure All SUID Executables Are Authorized | The SUID (set user id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthorized SUID files is determine if any were not installed as part of an RPM package, which is cryptographically verified. Investigate the origin of any unpackaged SUID files. This configuration check considers authorized SUID files which were installed via RPM. It is assumed that when an individual has sudo access to install an RPM and all packages are signed with an organizationally-recognized GPG key, the software should be considered an approved package on the system. Any SUID file not deployed through an RPM will be flagged for further review. | Executable files with the SUID permission run with the privileges of the owner of the file. SUID files of uncertain provenance could allow for unprivileged users to elevate privileges. The presence of these files should be strictly controlled on the system.
CM-6(a) | Install the ntp service | The ntpd service should be installed. | Time synchronization (using NTP) is required by almost all network and administrative tasks (syslog, cryptographic based services (authentication, etc.), etc.). Ntpd is regulary maintained and updated, supporting security features such as RFC 5906.
CM-6(a) AC-17(a) AC-17(2) | Require Encryption for Remote Access in GNOME3 | By default, `GNOME` requires encryption when using `Vino` for remote access. To prevent remote access encryption from being disabled, add or set `require-encryption` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/Vino]
    require-encryption=true
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/Vino/require-encryption
After the settings have been set, run `dconf update`. | Open X displays allow an attacker to capture keystrokes and to execute commands remotely.
CM-6(b) | Disable graphical user interface | By removing the following packages, the system no longer has X Windows installed. `xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils` If X Windows is not installed then the system cannot boot into graphical user mode. This prevents the system from being accidentally or maliciously booted into a `graphical.target` mode. To do so, run the following command:
    sudo yum remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils
| Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security vulnerabilities and should not be installed unless approved and documented.
CM-6(a) | Ensure Logrotate Runs Periodically | The `logrotate` utility allows for the automatic rotation of log files. The frequency of rotation is specified in `/etc/logrotate.conf`, which triggers a cron task. To configure logrotate to run daily, add or correct the following line in `/etc/logrotate.conf`:
    # rotate log files frequency
    daily
| Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
CM-6(a) | Ensure cron Is Logging To Rsyslog | Cron logging must be implemented to spot intrusions or trace cron job status. If `cron` is not logging to `rsyslog`, it can be implemented by adding the following to the RULES section of `/etc/rsyslog.conf`:
    cron.*                                                  /var/log/cron
| Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.
CM-6(a) AC-6(1) | Enable Kernel Parameter to Enforce DAC on Symlinks | To set the runtime status of the `fs.protected_symlinks` kernel parameter, run the following command:
    $ sudo sysctl -w fs.protected_symlinks=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    fs.protected_symlinks = 1
| By enabling this kernel parameter, symbolic links are permitted to be followed only when outside a sticky world-writable directory, or when the UID of the link and follower match, or when the directory owner matches the symlink's owner. Disallowing such symlinks helps mitigate vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of `open()` or `creat()`.
AC-6 CM-6(a) | Restrict Virtual Console Root Logins | To restrict root logins through the (deprecated) virtual console devices, ensure lines of this form do not appear in `/etc/securetty`:
    vc/1
    vc/2
    vc/3
    vc/4
| Preventing direct root login to virtual console devices helps ensure accountability for actions taken on the system using the root account.
CM-6(a) AC-6(1) CM-7(b) | Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3 | By default, `GNOME` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed. To configure the system to ignore the `Ctrl-Alt-Del` key sequence from the Graphical User Interface (GUI) instead of rebooting the system, add or set `logout` to `''` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/settings-daemon/plugins/media-keys]
    logout=''
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/settings-daemon/plugins/media-keys/logout
After the settings have been set, run `dconf update`. | A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
CM-6(a) | Build and Test AIDE Database | Run the following command to generate a new database:
    $ sudo /usr/sbin/aide --init
By default, the database will be written to the file `/var/lib/aide/aide.db.new.gz`. Storing the database, the configuration file `/etc/aide.conf`, and the binary `/usr/sbin/aide` (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity. The newly-generated database can be installed as follows:
    $ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
To initiate a manual check, run the following command:
    $ sudo /usr/sbin/aide --check
If this check produces any unexpected output, investigate. | For AIDE to be effective, an initial database of "known-good" information about files must be captured and it should be able to be verified against the installed files.
CM-6(a) | Enable cron Service | The `crond` service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary maintenance tasks, such as notifying root of system activity. The `crond` service can be enabled with the following command:
    $ sudo systemctl enable crond.service
| Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential.
CM-6(a) AU-8(1)(a) AU-8(2) | Specify Additional Remote NTP Servers | Additional NTP servers can be specified for time synchronization in the file `/etc/ntp.conf`. To do so, add additional lines of the following form, substituting the IP address or hostname of a remote NTP server for ntpserver:
    server ntpserver
| Specifying additional NTP servers increases the availability of accurate time data, in the event that one of the specified servers becomes unavailable. This is typical for a system acting as an NTP server for other systems.
CM-6(a) AU-8(1)(b) | Configure Time Service Maxpoll Interval | The `maxpoll` should be configured to `10` in `/etc/ntp.conf` or `/etc/chrony.conf` to continuously poll time servers. To configure `maxpoll` in `/etc/ntp.conf` or `/etc/chrony.conf` add the following after each `server`, `pool` or `peer` entry:
    maxpoll 10
to
    server
directives. If using chrony any
    pool
directives should be configured too. If no `server` or `pool` directives are configured, the rule evaluates to pass. | Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.
AC-6 AC-17(a) CM-6(a) | Enable Use of Strict Mode Checking | SSHs `StrictModes` option checks file and ownership permissions in the user's home directory `.ssh` folder before accepting login. If world- writable permissions are found, logon is rejected. The default SSH configuration has `StrictModes` enabled. The appropriate configuration is used if no value is set for `StrictModes`. To explicitly enable `StrictModes` in SSH, add or correct the following line in `/etc/ssh/sshd_config`:
    StrictModes yes
| If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.
CM-6(a) AC-6(1) | Verify User Who Owns shadow File | To properly set the owner of `/etc/shadow`, run the command:
    $ sudo chown root /etc/shadow
| The `/etc/shadow` file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.
CM-6 | Set number of records to cause an explicit flush to audit logs | To configure Audit daemon to issue an explicit flush to disk command after writing 50 records, set `freq` to `50` in `/etc/audit/auditd.conf`. | If option `freq` isn't set to `50`, the flush to disk may happen after higher number of records, increasing the danger of audit loss.
CM-6 | Write Audit Logs to the Disk | To configure Audit daemon to write Audit logs to the disk, set `write_logs` to `yes` in `/etc/audit/auditd.conf`. This is the default setting. | If `write_logs` isn't set to `yes`, the Audit logs will not be written to the disk.
CM-6(a) AC-7(b) IA-5(c) | Configure the root Account for Failed Password Attempts | This rule configures the system to lock out the `root` account after a number of incorrect login attempts using `pam_faillock.so`. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid any errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version. | By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, also known as brute-forcing, is reduced. Limits are imposed by locking the account.
CM-6(a) CM-5(6) CM-5(6).1 AC-6(1) | Verify that Shared Library Files Have Restrictive Permissions | System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default:
    /lib
    /lib64
    /usr/lib
    /usr/lib64
Kernel modules, which can be added to the kernel during runtime, are stored in `/lib/modules`. All files in these directories should not be group-writable or world-writable. If any file in these directories is found to be group-writable or world-writable, correct its permission with the following command:
    $ sudo chmod go-w FILE
| Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Restrictive permissions are necessary to protect the integrity of the system.
CM-6(a) AU-8(1)(a) | Enable the NTP Daemon | The `ntpd` service can be enabled with the following command:
    $ sudo systemctl enable ntpd.service
| Enabling the `ntpd` service ensures that the `ntpd` service will be running and that the system will synchronize its time to any servers specified. This is important whether the system is configured to be a client (and synchronize only its own clock) or it is also acting as an NTP server to other systems. Synchronizing time is essential for authentication services such as Kerberos, but it is also important for maintaining accurate logs and auditing possible security breaches. The NTP daemon offers all of the functionality of `ntpdate`, which is now deprecated.
CM-6(a) AC-6(1) | Verify the UEFI Boot Loader grub.cfg Permissions | File permissions for `/boot/efi/EFI/redhat/grub.cfg` should be set to 700. To properly set the permissions of `/boot/efi/EFI/redhat/grub.cfg`, run the command:
    $ sudo chmod 700 /boot/efi/EFI/redhat/grub.cfg
| Proper permissions ensure that only the root user can modify important boot parameters.
CM-6(a) AU-6(3) AU-6(4) | Enable rsyslog to Accept Messages via UDP, if Acting As Log Server | The `rsyslog` daemon should not accept remote messages unless the system acts as a log server. If the system needs to act as a central log server, add the following lines to `/etc/rsyslog.conf` to enable reception of messages over UDP:
    $ModLoad imudp
    $UDPServerRun 514
| Many devices, such as switches, routers, and other Unix-like systems, may only support the traditional syslog transmission over UDP. If the system must act as a log server, this enables it to receive their messages as well.
CM-6(a) AC-6(1) | Ensure All World-Writable Directories Are Owned by a System Account | All directories in local partitions which are world-writable should be owned by root or another system account. If any world-writable directories are not owned by a system account, this should be investigated. Following this, the files should be deleted or assigned to an appropriate owner. | Allowing a user account to own a world-writable directory is undesirable because it allows the owner of that directory to remove or replace any files that may be placed in the directory by other users.
CM-6(b) | Disable X11 Forwarding | The X11Forwarding parameter provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections. SSH has the capability to encrypt remote X11 connections when SSH's `X11Forwarding` option is enabled. The default SSH configuration disables X11Forwarding. The appropriate configuration is used if no value is set for `X11Forwarding`. To explicitly disable X11 Forwarding, add or correct the following line in `/etc/ssh/sshd_config`:
    X11Forwarding no
| Disable X11 forwarding unless there is an operational requirement to use X11 applications directly. There is a small risk that the remote X11 servers of users who are logged in via SSH with X11 forwarding could be compromised by other users on the X11 server. Note that even if X11 forwarding is disabled, users can always install their own forwarders.
CM-6 SC-7(10) | Disable Core Dumps for All Users | To disable core dumps for all users, add the following line to `/etc/security/limits.conf`, or to a file within the `/etc/security/limits.d/` directory:
    *     hard   core    0
| A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
CM-6(a) | Root Path Must Be Vendor Default | Assuming root shell is bash, edit the following files:
    ~/.profile
    ~/.bashrc
Change any `PATH` variables to the vendor default for root and remove any empty `PATH` entries or references to relative paths. | The root account's executable search path must be the vendor default, and must contain only absolute paths.
CM-6(a) AC-6(1) | Verify Group Who Owns group File | To properly set the group owner of `/etc/group`, run the command:
    $ sudo chgrp root /etc/group
| The `/etc/group` file contains information regarding groups that are configured on the system. Protection of this file is important for system security.
CM-6(a) AC-6(1) | Verify that All World-Writable Directories Have Sticky Bits Set | When the so-called 'sticky bit' is set on a directory, only the owner of a given file may remove that file from the directory. Without the sticky bit, any user with write access to a directory may remove any file in the directory. Setting the sticky bit prevents users from removing each other's files. In cases where there is no reason for a directory to be world-writable, a better solution is to remove that permission rather than to set the sticky bit. However, if a directory is used by a particular application, consult that application's documentation instead of blindly changing modes. To set the sticky bit on a world-writable directory DIR, run the following command:
    $ sudo chmod +t DIR
| Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure. The only authorized public directories are those temporary directories supplied with the system, or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system, by users for temporary file storage (such as `/tmp`), and for directories requiring global read/write access.
CM-6(a) SC-28 SI-3(a) | Install McAfee Virus Scanning Software | Install McAfee VirusScan Enterprise for Linux antivirus software which is provided for DoD systems and uses signatures to search for the presence of viruses on the filesystem. | Virus scanning software can be used to detect if a system has been compromised by computer viruses, as well as to limit their spread to other systems.
CM-6(a) | Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period | If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding
    /org/gnome/desktop/screensaver/lock-enabled
to `/etc/dconf/db/local.d/00-security-settings`. For example:
    /org/gnome/desktop/screensaver/lock-enabled
After the settings have been set, run `dconf update`. | A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to logout because of the temporary nature of the absense.
CM-6(a) | Install the cron service | The Cron service should be installed. | The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
CM-6(a) AC-6(1) | Disable Ctrl-Alt-Del Reboot Activation | By default, `SystemD` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed. To configure the system to ignore the `Ctrl-Alt-Del` key sequence from the command line instead of rebooting the system, do either of the following:
    ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target
or
    systemctl mask ctrl-alt-del.target
Do not simply delete the `/usr/lib/systemd/system/ctrl-alt-del.service` file, as this file may be restored during future system updates. | A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
- CM-6(a) AC-7(a) | Set Interval For Counting Failed Password Attempts | Utilizing `pam_faillock.so`, the `fail_interval` directive configures the system to lock out an account after a number of incorrect login attempts within a specified time period. First make sure the feature is enabled using the following command:
      authselect enable-feature with-faillock
- Then edit the `/etc/security/faillock.conf` file as follows: add, uncomment or edit the following line:
      fail_interval = 900
- add or uncomment the following line:
      silent
| By limiting the number of failed logon attempts the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.
CM-6(a) AC-6(1) | Verify the UEFI Boot Loader grub.cfg Group Ownership | The file `/boot/efi/EFI/redhat/grub.cfg` should be group-owned by the `root` group to prevent destruction or modification of the file. To properly set the group owner of `/boot/efi/EFI/redhat/grub.cfg`, run the command:
    $ sudo chgrp root /boot/efi/EFI/redhat/grub.cfg
| The `root` group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway.
CM-6(a) CM-3(5) | Configure Notification of Post-AIDE Scan Details | AIDE should notify appropriate personnel of the details of a scan after the scan has been run. If AIDE has already been configured for periodic execution in `/etc/crontab`, append the following line to the existing AIDE line:
     | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost
Otherwise, add the following line to `/etc/crontab`:
    05 4 * * * root /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost
AIDE can be executed periodically through other means; this is merely one example. | Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security. Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.
CM-6(a) AC-6(1) | Ensure Log Files Are Owned By Appropriate User | The owner of all log files written by `rsyslog` should be ``root``. These log files are determined by the second part of each Rule line in `/etc/rsyslog.conf` and typically all appear in `/var/log`. For each log file LOGFILE referenced in `/etc/rsyslog.conf`, run the following command to inspect the file's owner:
    $ ls -l LOGFILE
If the owner is not ``root``, run the following command to correct this:
    $ sudo chown root LOGFILE
| The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access.
CM-6(b) CM-6.1(iv) | Ensure There Are No Accounts With Blank or Null Passwords | Check the "/etc/shadow" file for blank passwords with the following command:
    $ sudo awk -F: '!$2 {print $1}' /etc/shadow
If the command returns any results, this is a finding. Configure all accounts on the system to have a password or lock the account with the following commands: Perform a password reset:
    $ sudo passwd [username]
Lock an account:
    $ sudo passwd -l [username]
| If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
CM-6(a) AU-8(1)(a) | A remote time server for Chrony is configured | `Chrony` is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on `chrony` can be found at http://chrony.tuxfamily.org/. `Chrony` can be configured to be a client and/or a server. Add or edit server or pool lines to `/etc/chrony.conf` as appropriate:
    server <remote-server>
Multiple servers may be configured. | If `chrony` is in use on the system proper configuration is vital to ensuring time synchronization is working properly.
CM-6(b) CM-6(iv) | The operating system must restrict privilege elevation to authorized personnel | The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms your request to execute a command by checking a file, called sudoers. Restrict privileged actions by removing the following entries from the sudoers file: `ALL ALL=(ALL) ALL` `ALL ALL=(ALL:ALL) ALL` | If the "sudoers" file is not configured correctly, any user defined on the system can initiate privileged actions on the target system.
CM-6(a) AC-17(a) AC-17(2) SC-13 MA-4(6) IA-5(1)(c) SC-12(2) SC-12(3) | Use Only FIPS 140-2 Validated Ciphers | Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. The following line in `/etc/ssh/sshd_config` demonstrates use of FIPS-approved ciphers:
    Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
The man page `sshd_config(5)` contains a list of supported ciphers. Only the following ciphers are FIPS 140-2 certified on Oracle Linux 7: - aes128-ctr - aes192-ctr - aes256-ctr - aes128-cbc - aes192-cbc - aes256-cbc - 3des-cbc - rijndael-cbc@lysator.liu.se Any combination of the above ciphers will pass this check. Official FIPS 140-2 paperwork for Oracle Linux 7 can be found at https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3028.pdf The rule is parametrized to use the following ciphers: ``aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se``. | Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and system data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets industry and government requirements. For government systems, this allows Security Levels 1, 2, 3, or 4 for use on Oracle Linux 7.
CM-6 AU-3 | Set hostname as computer node name in audit logs | To configure Audit daemon to use value returned by gethostname syscall as computer node name in the audit events, set `name_format` to `hostname` in `/etc/audit/auditd.conf`. | If option `name_format` is left at its default value of `none`, audit events from different computers may be hard to distinguish.
CM-6(a) | Install the screen Package | To enable console screen locking, install the `screen` package. The `screen` package can be installed with the following command:
    $ sudo yum install screen
Instruct users to begin new terminal sessions with the following command:
    $ screen
The console can now be locked with the following key combination:
    ctrl+a x
| A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operation system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock. The `screen` package allows for a session lock to be implemented and configured.
CM-6(b) CM-6.1(iv) | Ensure invoking users password for privilege escalation when using sudo | The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validates the invoking user's credentials. The expected output for:
    sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'
     /etc/sudoers:Defaults !targetpw
          /etc/sudoers:Defaults !rootpw
          /etc/sudoers:Defaults !runaspw
| If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt the invoking user for the "root" user password.
CM-6(a) AU-4 SC-5(2) | Ensure /var/log Located On Separate Partition | System logs are stored in the `/var/log` directory. Ensure that `/var/log` has its own partition or logical volume at installation time, or migrate it using LVM. | Placing `/var/log` in its own partition enables better separation between log files and other files in `/var/`.
CM-6(a) | Install Smart Card Packages For Multifactor Authentication | Configure the operating system to implement multifactor authentication by installing the required package with the following command: The `pam_pkcs11` package can be installed with the following command:
    $ sudo yum install pam_pkcs11
| Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.
CM-6(a) | Ensure rsyslog is Installed | Rsyslog is installed by default. The `rsyslog` package can be installed with the following command:
     $ sudo yum install rsyslog
| The rsyslog package provides the rsyslog daemon, which provides system logging services.
CM-6(a) AC-6(1) CM-7(b) | Disable GDM Automatic Login | The GNOME Display Manager (GDM) can allow users to automatically login without user interaction or credentials. User should always be required to authenticate themselves to the system that they are authorized to use. To disable user ability to automatically login to the system, set the `AutomaticLoginEnable` to `false` in the `[daemon]` section in `/etc/gdm/custom.conf`. For example:
    [daemon]
    AutomaticLoginEnable=false
| Failure to restrict system access to authenticated users negatively impacts operating system security.
CM-6(a) AC-23 | Disable the GNOME3 Login User List | In the default graphical environment, users logging directly into the system are greeted with a login screen that displays all known users. This functionality should be disabled by setting `disable-user-list` to `true`. To disable, add or edit `disable-user-list` to `/etc/dconf/db/gdm.d/00-security-settings`. For example:
    [org/gnome/login-screen]
    disable-user-list=true
Once the setting has been added, add a lock to `/etc/dconf/db/gdm.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/login-screen/disable-user-list
After the settings have been set, run `dconf update`. | Leaving the user list enabled is a security risk since it allows anyone with physical access to the system to quickly enumerate known user accounts without logging in.
CM-6(a) AU-8(1)(a) AU-8(2) | Specify a Remote NTP Server | Depending on specific functional requirements of a concrete production environment, the Oracle Linux 7 system can be configured to utilize the services of the `chronyd` NTP daemon (the default), or services of the `ntpd` NTP daemon. Refer to https://docs.oracle.com/en/operating-systems/oracle-linux/7/network/ol7-nettime.html for more detailed comparison of the features of both of the choices, and for further guidance how to choose between the two NTP daemons. To specify a remote NTP server for time synchronization, perform the following: if the system is configured to use the `chronyd` as the NTP daemon (the default), edit the file `/etc/chrony.conf` as follows, if the system is configured to use the `ntpd` as the NTP daemon, edit the file `/etc/ntp.conf` as documented below. Add or correct the following lines, substituting the IP or hostname of a remote NTP server for ntpserver:
    server ntpserver
This instructs the NTP software to contact that remote server to obtain time data. | Synchronizing with an NTP server makes it possible to collate system logs from multiple sources or correlate computer events with real time events.
CM-6(a) AC-6(1) | Ensure Log Files Are Owned By Appropriate Group | The group-owner of all log files written by `rsyslog` should be ``root``. These log files are determined by the second part of each Rule line in `/etc/rsyslog.conf` and typically all appear in `/var/log`. For each log file LOGFILE referenced in `/etc/rsyslog.conf`, run the following command to inspect the file's group owner:
    $ ls -l LOGFILE
If the owner is not ``root``, run the following command to correct this:
    $ sudo chgrp root LOGFILE
| The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access.
CM-6(a) | Install iptables Package | The `iptables` package can be installed with the following command:
    $ sudo yum install iptables
| `iptables` controls the Linux kernel network packet filtering code. `iptables` allows system operators to set up firewalls and IP masquerading, etc.
CM-6(a) AC-17(a) AC-2(5) AC-12 AC-17(a) SC-10 CM-6(a) | Set SSH Idle Timeout Interval | SSH allows administrators to set an idle timeout interval. After this interval has passed, the idle user will be automatically logged out. To set an idle timeout interval, edit the following line in `/etc/ssh/sshd_config` as follows:
    ClientAliveInterval 300
The timeout interval is given in seconds. For example, have a timeout of 10 minutes, set interval to 600. If a shorter timeout has already been set for the login shell, that value will preempt any SSH setting made in `/etc/ssh/sshd_config`. Keep in mind that some processes may stop SSH from correctly detecting that the user is idle. | Terminating an idle ssh session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been let unattended.
CM-6 AU-3 | Resolve information before writing to audit logs | To configure Audit daemon to resolve all uid, gid, syscall, architecture, and socket address information before writing the events to disk, set `log_format` to `ENRICHED` in `/etc/audit/auditd.conf`. | If option `log_format` isn't set to `ENRICHED`, the audit records will be stored in a format exactly as the kernel sends them.
CM-6(d) CM-6(c) SI-7 SI-7(1) SI-7(6) AU-9(3) | Verify File Hashes with RPM | Without cryptographic integrity protections, system executables and files can be altered by unauthorized users without detection. The RPM package management system can check the hashes of installed software packages, including many that are important to system security. To verify that the cryptographic hash of system files and commands matches vendor values, run the following command to list which files on the system have hashes that differ from what is expected by the RPM database:
    $ rpm -Va --noconfig | grep '^..5'
A "c" in the second column indicates that a file is a configuration file, which may appropriately be expected to change. If the file was not expected to change, investigate the cause of the change using audit logs or other means. The package can then be reinstalled to restore the file. Run the following command to determine which package owns the file:
    $ rpm -qf FILENAME
The package can be reinstalled from a yum repository using the command:
    $ sudo yum reinstall PACKAGENAME
Alternatively, the package can be reinstalled from trusted media using the command:
    $ sudo rpm -Uvh PACKAGENAME
| The hashes of important files like system executables should match the information given by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity on the system.
CM-6(a) | Install libreswan Package | The Libreswan package provides an implementation of IPsec and IKE, which permits the creation of secure tunnels over untrusted networks. The `libreswan` package can be installed with the following command:
    $ sudo yum install libreswan
| Providing the ability for remote users or systems to initiate a secure VPN connection protects information when it is transmitted over a wide area network.
CM-6(a) AC-17(a) AC-17(2) SC-13 MA-4(6) SC-12(2) SC-12(3) | Use Only FIPS 140-2 Validated MACs | Limit the MACs to those hash algorithms which are FIPS-approved. The following line in `/etc/ssh/sshd_config` demonstrates use of FIPS-approved MACs:
    MACs hmac-sha2-512,hmac-sha2-256,hmac-sha1
The man page `sshd_config(5)` contains a list of supported MACs. Only the following message authentication codes are FIPS 140-2 certified on Oracle Linux 7: - hmac-sha1 - hmac-sha2-256 - hmac-sha2-512 - hmac-sha1-etm@openssh.com - hmac-sha2-256-etm@openssh.com - hmac-sha2-512-etm@openssh.com Any combination of the above MACs will pass this check. Official FIPS 140-2 paperwork for Oracle Linux 7 can be found at https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3028.pdf The rule is parametrized to use the following MACs: ``hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com``. | DoD Information Systems are required to use FIPS-approved cryptographic hash functions. The only SSHv2 hash algorithms meeting this requirement is SHA2.
CM-6(d) CM-6(c) SI-7 SI-7(1) SI-7(6) AU-9(3) CM-6(a) | Verify and Correct File Permissions with RPM | The RPM package management system can check file access permissions of installed software packages, including many that are important to system security. Verify that the file permissions of system files and commands match vendor values. Check the file permissions with the following command:
    $ sudo rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }'
Output indicates files that do not match vendor defaults. After locating a file with incorrect permissions, run the following command to determine which package owns it:
    $ rpm -qf FILENAME
Next, run the following command to reset its permissions to the correct values:
    $ sudo rpm --setperms PACKAGENAME
| Permissions on system binaries and configuration files that are too generous could allow an unauthorized user to gain privileges that they should not have. The permissions set by the vendor should be maintained. Any deviations from this baseline should be investigated.
CM-6(a) AC-6(1) | Ensure System Log Files Have Correct Permissions | The file permissions for all log files written by `rsyslog` should be set to 600, or more restrictive. These log files are determined by the second part of each Rule line in `/etc/rsyslog.conf` and typically all appear in `/var/log`. For each log file LOGFILE referenced in `/etc/rsyslog.conf`, run the following command to inspect the file's permissions:
    $ ls -l LOGFILE
If the permissions are not 600 or more restrictive, run the following command to correct this:
    $ sudo chmod 0600 LOGFILE
" | Log files can contain valuable information regarding system configuration. If the system log files are not protected unauthorized users could change the logged data, eliminating their forensic value.
CM-6(a) | Ensure syslog-ng is Installed | syslog-ng can be installed in replacement of rsyslog. The `syslog-ng-core` package can be installed with the following command:
    $ sudo yum install syslog-ng-core
| The syslog-ng-core package provides the syslog-ng daemon, which provides system logging services.
CM-6(a) AU-8(1)(a) | Enable the NTP Daemon | The `ntpd` service can be enabled with the following command:
    $ sudo systemctl enable ntpd.service
| Enabling the `ntpd` service ensures that the `ntpd` service will be running and that the system will synchronize its time to any servers specified. This is important whether the system is configured to be a client (and synchronize only its own clock) or it is also acting as an NTP server to other systems. Synchronizing time is essential for authentication services such as Kerberos, but it is also important for maintaining accurate logs and auditing possible security breaches. The NTP daemon offers all of the functionality of `ntpdate`, which is now deprecated.
CM-6(a) | Enable page allocator poisoning | To enable poisoning of free pages, add the argument `page_poison=1` to the default GRUB 2 command line for the Linux operating system. To ensure that `page_poison=1` is added as a kernel command line argument to newly installed kernels, ad `page_poison=1` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... page_poison=1 ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="page_poison=1"
| Poisoning writes an arbitrary value to freed pages, so any modification or reference to that page after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory.
CM-6(a) AC-6(1) | Verify Permissions on passwd File | To properly set the permissions of `/etc/passwd`, run the command:
    $ sudo chmod 0644 /etc/passwd
| If the `/etc/passwd` file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security.
CM-6(a) | Extend Audit Backlog Limit for the Audit Daemon | To improve the kernel capacity to queue all log events, even those which occurred prior to the audit daemon, add the argument `audit_backlog_limit=8192` to the default GRUB 2 command line for the Linux operating system. To ensure that `audit_backlog_limit=8192` is added as a kernel command line argument to newly installed kernels, ad `audit_backlog_limit=8192` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... audit_backlog_limit=8192 ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="audit_backlog_limit=8192"
| audit_backlog_limit sets the queue length for audit events awaiting transfer to the audit daemon. Until the audit daemon is up and running, all log messages are stored in this queue. If the queue is overrun during boot process, the action defined by audit failure flag is taken.
CM-6(a) | Enable GNOME3 Screensaver Lock After Idle Period | To activate locking of the screensaver in the GNOME3 desktop when it is activated, add or set `lock-enabled` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/screensaver]
    lock-enabled=true
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/screensaver/lock-enabled
After the settings have been set, run `dconf update`. | A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to logout because of the temporary nature of the absense.
CM-6(a) MA-6 SA-13(a) | The Installed Operating System Is Vendor Supported | The installed operating system must be maintained by a vendor. Oracle Linux is supported by Oracle Corporation. As the Oracle Linux vendor, Oracle Corporation is responsible for providing security patches. | An operating system is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve any security issue discovered in the system software.
CM-6(a) AU-8(1)(a) | Specify a Remote NTP Server | To specify a remote NTP server for time synchronization, edit the file `/etc/ntp.conf`. Add or correct the following lines, substituting the IP or hostname of a remote NTP server for ntpserver:
    server ntpserver
This instructs the NTP software to contact that remote server to obtain time data. | Synchronizing with an NTP server makes it possible to collate system logs from multiple sources or correlate computer events with real time events.
CM-6(a) AC-6(1) AU-9 | System Audit Logs Must Have Mode 0750 or Less Permissive | If `log_group` in `/etc/audit/auditd.conf` is set to a group other than the `root` group account, change the mode of the audit log files with the following command:
    $ sudo chmod 0750 /var/log/audit
Otherwise, change the mode of the audit log files with the following command:
    $ sudo chmod 0700 /var/log/audit
| If users can write to audit logs, audit trails can be modified or destroyed.
CM-6(a) | Ensure Users Cannot Change GNOME3 Screensaver Settings | If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding `/org/gnome/desktop/screensaver/lock-delay` to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/screensaver/lock-delay
After the settings have been set, run `dconf update`. | A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the session lock. As such, users should not be allowed to change session settings.
CM-6(a) AC-7(a) | Lock Accounts After Failed Password Attempts | This rule configures the system to lock out accounts after a number of incorrect login attempts using `pam_faillock.so`. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid any errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version. | Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. In combination with the `silent` option, user enumeration attacks are also mitigated.
CM-6(a) AC-6(1) | Ensure All Files Are Owned by a Group | If any files are not owned by a group, then the cause of their lack of group-ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate group. The following command will discover and print any files on local partitions which do not belong to a valid group:
    $ df --local -P | awk '{if (NR!=1) print $6}' | sudo xargs -I '{}' find '{}' -xdev -nogroup
To search all filesystems on a system including network mounted filesystems the following command can be run manually for each partition:
    $ sudo find PARTITION -xdev -nogroup
| Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed.
AC-6 AC-6(8) AC-6(10) CM-6(a) | Mount Remote Filesystems with noexec | Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of any NFS mounts. | The noexec mount option causes the system not to execute binary files. This option must be used for mounting any file system not containing approved binary files as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.
CM-6(a) AU-8(1)(a) AU-8(2) | Specify Additional Remote NTP Servers | Depending on specific functional requirements of a concrete production environment, the Oracle Linux 7 system can be configured to utilize the services of the `chronyd` NTP daemon (the default), or services of the `ntpd` NTP daemon. Refer to https://docs.oracle.com/en/operating-systems/oracle-linux/7/network/ol7-nettime.html for more detailed comparison of the features of both of the choices, and for further guidance how to choose between the two NTP daemons. Additional NTP servers can be specified for time synchronization. To do so, perform the following: if the system is configured to use the `chronyd` as the NTP daemon (the default), edit the file `/etc/chrony.conf` as follows, if the system is configured to use the `ntpd` as the NTP daemon, edit the file `/etc/ntp.conf` as documented below. Add additional lines of the following form, substituting the IP address or hostname of a remote NTP server for ntpserver:
    server ntpserver
| Specifying additional NTP servers increases the availability of accurate time data, in the event that one of the specified servers becomes unavailable. This is typical for a system acting as an NTP server for other systems.
CM-6(a) IA-5(13) | Configure SSSD to Expire Offline Credentials | SSSD should be configured to expire offline credentials after 1 day. To configure SSSD to expire offline credentials, set `offline_credentials_expiration` to `1` under the `[pam]` section in `/etc/sssd/sssd.conf`. For example:
    [pam]
    offline_credentials_expiration = 1
| If cached authentication information is out-of-date, the validity of the authentication information may be questionable.
CM-6(a) AU-6(3) AU-6(4) | Enable rsyslog to Accept Messages via TCP, if Acting As Log Server | The `rsyslog` daemon should not accept remote messages unless the system acts as a log server. If the system needs to act as a central log server, add the following lines to `/etc/rsyslog.conf` to enable reception of messages over TCP:
    $ModLoad imtcp
    $InputTCPServerRun 514
| If the system needs to act as a log server, this ensures that it can receive messages over a reliable TCP connection.
CM-6(a) | Install sudo Package | The `sudo` package can be installed with the following command:
    $ sudo yum install sudo
| `sudo` is a program designed to allow a system administrator to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
CM-6(a) SC-5(2) | Ensure /home Located On Separate Partition | If user home directories will be stored locally, create a separate partition for `/home` at installation time (or migrate it later using LVM). If `/home` will be mounted from another system such as an NFS server, then creating a separate partition is not necessary at installation time, and the mountpoint can instead be configured later. | Ensuring that `/home` is mounted on its own partition enables the setting of more restrictive mount options, and also helps ensure that users cannot trivially fill partitions used for log or audit data storage.
CM-6(a) MP-2 | Mount Remote Filesystems with nodev | Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of any NFS mounts. | Legitimate device files should only exist in the /dev directory. NFS mounts should not present device files to users.
CM-6(a) AC-7(b) | Set Lockout Time for Failed Password Attempts | This rule configures the system to lock out accounts during a specified time period after a number of incorrect login attempts using `pam_faillock.so`. pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid any errors when manually editing these files, it is recommended to use the appropriate tools, such as `authselect` or `authconfig`, depending on the OS version. | Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. Ensuring that an administrator is involved in unlocking locked accounts draws appropriate attention to such situations.
CM-6(a) | Set the Boot Loader Admin Username to a Non-Default Value | The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. To maximize the protection, select a password-protected superuser account with unique name, and modify the `/etc/grub.d/01_users` configuration file to reflect the account name change. Do not to use common administrator account names like root, admin, or administrator for the grub2 superuser account. Change the superuser to a different username (The default is 'root').
    $ sed -i 's/\(set superuser=\).*/\1"<unique user ID>"/g' /etc/grub.d/01_users
Once the superuser account has been added, update the `grub.cfg` file by running:
    grub2-mkconfig -o /boot/grub2/grub.cfg
| Having a non-default grub superuser username makes password-guessing attacks less effective.
CM-6(a) AC-6(1) | Verify /boot/grub2/grub.cfg User Ownership | The file `/boot/grub2/grub.cfg` should be owned by the `root` user to prevent destruction or modification of the file. To properly set the owner of `/boot/grub2/grub.cfg`, run the command:
    $ sudo chown root /boot/grub2/grub.cfg
| Only root should be able to modify important boot parameters.
CM-6(a) AC-6(1) CM-7(b) | Disable the GNOME3 Login Restart and Shutdown Buttons | In the default graphical environment, users logging directly into the system are greeted with a login screen that allows any user, known or unknown, the ability the ability to shutdown or restart the system. This functionality should be disabled by setting `disable-restart-buttons` to `true`. To disable, add or edit `disable-restart-buttons` to `/etc/dconf/db/gdm.d/00-security-settings`. For example:
    [org/gnome/login-screen]
    disable-restart-buttons=true
Once the setting has been added, add a lock to `/etc/dconf/db/gdm.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/login-screen/disable-restart-buttons
After the settings have been set, run `dconf update`. | A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons are pressed at the login screen, this can create the risk of short-term loss of availability of systems due to reboot.
CM-6(a) AC-17(a) AC-6 | Enable Use of Privilege Separation | When enabled, SSH will create an unprivileged child process that has the privilege of the authenticated user. To enable privilege separation in SSH, add or correct the following line in the `/etc/ssh/sshd_config` file:
    UsePrivilegeSeparation sandbox
| SSH daemon privilege separation causes the SSH process to drop root privileges when not needed which would decrease the impact of software vulnerabilities in the unprivileged section.
CM-6(a) | Ensure Users Cannot Change GNOME3 Screensaver Idle Activation | If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding
    /org/gnome/desktop/screensaver/idle-activation-enabled
to `/etc/dconf/db/local.d/00-security-settings`. For example:
    /org/gnome/desktop/screensaver/idle-activation-enabled
After the settings have been set, run `dconf update`. | A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to logout because of the temporary nature of the absense.
CM-6(a) AU-8(1)(a) | Enable the NTP Daemon | Run the following command to determine the current status of the `chronyd` service:
    $ systemctl is-active chronyd
If the service is running, it should return the following:
    active
Note: The `chronyd` daemon is enabled by default. Run the following command to determine the current status of the `ntpd` service:
    $ systemctl is-active ntpd
If the service is running, it should return the following:
    active
Note: The `ntpd` daemon is not enabled by default. Though as mentioned in the previous sections in certain environments the `ntpd` daemon might be preferred to be used rather than the `chronyd` one. Refer to: https://docs.oracle.com/en/operating-systems/oracle-linux/7/network/ol7-nettime.html for guidance which NTP daemon to choose depending on the environment used. | Enabling some of `chronyd` or `ntpd` services ensures that the NTP daemon will be running and that the system will synchronize its time to any servers specified. This is important whether the system is configured to be a client (and synchronize only its own clock) or it is also acting as an NTP server to other systems. Synchronizing time is essential for authentication services such as Kerberos, but it is also important for maintaining accurate logs and auditing possible security breaches. The `chronyd` and `ntpd` NTP daemons offer all of the functionality of `ntpdate`, which is now deprecated.
CM-6(a) | Configure System to Forward All Mail For The Root Account | Make sure that mails delivered to root user are forwarded to a monitored email address. Make sure that the address `system.administrator@mail.mil` is a valid email address reachable from the system in question. Use the following command to configure the alias:
    $ sudo echo "root: system.administrator@mail.mil" >> /etc/aliases
    $ sudo newaliases
| A number of system services utilize email messages sent to the root user to notify system administrators of active or impending issues. These messages must be forwarded to at least one monitored email address.
CM-6(a) SC-5(2) | Ensure /var Located On Separate Partition | The `/var` directory is used by daemons and other system services to store frequently-changing data. Ensure that `/var` has its own partition or logical volume at installation time, or migrate it using LVM. | Ensuring that `/var` is mounted on its own partition enables the setting of more restrictive mount options. This helps protect system services such as daemons or other programs which use it. It is not uncommon for the `/var` directory to contain world-writable directories installed by other software packages.
CM-6(a) AC-6(1) | Verify User Who Owns group File | To properly set the owner of `/etc/group`, run the command:
    $ sudo chown root /etc/group
| The `/etc/group` file contains information regarding groups that are configured on the system. Protection of this file is important for system security.
CM-6(a) SC-5(2) | Ensure /tmp Located On Separate Partition | The `/tmp` directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM. | The `/tmp` partition is used as temporary storage by many programs. Placing `/tmp` in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.
CM-6(a) AC-17(a) AC-17(2) | Enable Encrypted X11 Forwarding | By default, remote X11 connections are not encrypted when initiated by users. SSH has the capability to encrypt remote X11 connections when SSH's `X11Forwarding` option is enabled. To enable X11 Forwarding, add or correct the following line in `/etc/ssh/sshd_config`:
    X11Forwarding yes
| Non-encrypted X displays allow an attacker to capture keystrokes and to execute commands remotely.
CM-6(a) | Enable SLUB/SLAB allocator poisoning | To enable poisoning of SLUB/SLAB objects, add the argument `slub_debug=P` to the default GRUB 2 command line for the Linux operating system. To ensure that `slub_debug=P` is added as a kernel command line argument to newly installed kernels, ad `slub_debug=P` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... slub_debug=P ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="slub_debug=P"
| Poisoning writes an arbitrary value to freed objects, so any modification or reference to that object after being freed or before being initialized will be detected and prevented. This prevents many types of use-after-free vulnerabilities at little performance cost. Also prevents leak of data and detection of corrupted memory.
CM-6(a) AC-6(1) CM-6(a) | Ensure that User Home Directories are not Group-Writable or World-Readable | For each human user of the system, view the permissions of the user's home directory:
    # ls -ld /home/USER
Ensure that the directory is not group-writable and that it is not world-readable. If necessary, repair the permissions:
    # chmod g-w /home/USER
    # chmod o-rwx /home/USER
| User home directories contain many configuration files which affect the behavior of a user's account. No user should ever have write permission to another user's home directory. Group shared directories can be configured in sub-directories or elsewhere in the filesystem if they are needed. Typically, user home directories should not be world-readable, as it would disclose file names to other users. If a subset of users need read access to one another's home directories, this can be provided using groups or ACLs.
CM-6(a) AU-4(1) | Enable rsyslog Service | The `rsyslog` service provides syslog-style logging by default on Oracle Linux 7. The `rsyslog` service can be enabled with the following command:
    $ sudo systemctl enable rsyslog.service
| The `rsyslog` service must be running in order to provide logging services, which are essential to system administration.
CM-6(b) | Prevent remote hosts from connecting to the proxy display | The SSH daemon should prevent remote hosts from connecting to the proxy display. The default SSH configuration for `X11UseLocalhost` is `yes`, which prevents remote hosts from connecting to the proxy display. To explicitly prevent remote connections to the proxy display, add or correct the following line in `/etc/ssh/sshd_config`: `X11UseLocalhost yes` | When X11 forwarding is enabled, there may be additional exposure to the server and client displays if the sshd proxy display is configured to listen on the wildcard address. By default, sshd binds the forwarding server to the loopback address and sets the hostname part of the `DISPLAY` environment variable to localhost. This prevents remote hosts from connecting to the proxy display.
CM-6 | Include Local Events in Audit Logs | To configure Audit daemon to include local events in Audit logs, set `local_events` to `yes` in `/etc/audit/auditd.conf`. This is the default setting. | If option `local_events` isn't set to `yes` only events from network will be aggregated.
CM-6(a) AC-6(1) | Verify the UEFI Boot Loader grub.cfg User Ownership | The file `/boot/efi/EFI/redhat/grub.cfg` should be owned by the `root` user to prevent destruction or modification of the file. To properly set the owner of `/boot/efi/EFI/redhat/grub.cfg`, run the command:
    $ sudo chown root /boot/efi/EFI/redhat/grub.cfg
| Only root should be able to modify important boot parameters.
CM-6(a) | Install the Host Intrusion Prevention System (HIPS) Module | Install the McAfee Host Intrusion Prevention System (HIPS) Module if it is absolutely necessary. If SELinux is enabled, do not install or enable this module. | Without a host-based intrusion detection tool, there is no system-level defense when an intruder gains access to a system or network. Additionally, a host-based intrusion prevention tool can provide methods to immediately lock out detected intrusion attempts.
CM-6(a) AC-6(1) | Verify Permissions on gshadow File | To properly set the permissions of `/etc/gshadow`, run the command:
    $ sudo chmod 0000 /etc/gshadow
| The `/etc/gshadow` file contains group password hashes. Protection of this file is critical for system security.
CM-6(a) AC-6(1) | Verify User Who Owns passwd File | To properly set the owner of `/etc/passwd`, run the command:
    $ sudo chown root /etc/passwd
| The `/etc/passwd` file contains information about the users that are configured on the system. Protection of this file is critical for system security.
CM-6(a) | Install the OpenSSH Server Package | The `openssh-server` package should be installed. The `openssh-server` package can be installed with the following command:
    $ sudo yum install openssh-server
| Without protection of the transmitted information, confidentiality, and integrity may be compromised because unprotected communications can be intercepted and either read or altered.
AC-6 CM-6(a) CM-6(b) CM-6.1(iv) | Ensure that System Accounts Do Not Run a Shell Upon Login | Some accounts are not associated with a human user of the system, and exist to perform some administrative function. Should an attacker be able to log into these accounts, they should not be granted access to a shell. The login shell for each local account is stored in the last field of each line in `/etc/passwd`. System accounts are those user accounts with a user ID less than UID_MIN, where value of UID_MIN directive is set in /etc/login.defs configuration file. In the default configuration UID_MIN is set to 1000, thus system accounts are those user accounts with a user ID less than 1000. The user ID is stored in the third field. If any system account SYSACCT (other than root) has a login shell, disable it with the command:
    $ sudo usermod -s /sbin/nologin SYSACCT
| Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts.
CM-6 | Disable debug-shell SystemD Service | SystemD's `debug-shell` service is intended to diagnose SystemD related boot issues with various `systemctl` commands. Once enabled and following a system reboot, the root shell will be available on `tty9` which is access by pressing `CTRL-ALT-F9`. The `debug-shell` service should only be used for SystemD related issues and should otherwise be disabled. By default, the `debug-shell` SystemD service is already disabled. The `debug-shell` service can be disabled with the following command:
    $ sudo systemctl mask --now debug-shell.service
| This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
CM-6(a) | Set the UEFI Boot Loader Password | The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. Since plaintext passwords are a security risk, generate a hash for the password by running the following command:
    # grub2-setpassword
When prompted, enter the password that was selected. | Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.
CM-6(a) AU-4(1) AU-9(2) | Ensure Logs Sent To Remote Host | To configure rsyslog to send logs to a remote log server, open `/etc/rsyslog.conf` and read and understand the last section of the file, which describes the multiple directives necessary to activate remote logging. Along with these other directives, the system can be configured to forward its logs to a particular log server by adding or correcting one of the following lines, substituting ``logcollector`` appropriately. The choice of protocol depends on the environment of the system; although TCP and RELP provide more reliable message delivery, they may not be supported in all environments. To use UDP for log message delivery:
    *.* @logcollector
To use TCP for log message delivery:
    *.* @@logcollector
To use RELP for log message delivery:
    *.* :omrelp:logcollector
There must be a resolvable DNS CNAME or Alias record set to "`logcollector`" for logs to be sent correctly to the centralized logging utility. | A log server (loghost) receives syslog messages from one or more systems. This data can be used as an additional log source in the event a system is compromised and its local logs are suspect. Forwarding log messages to a remote loghost also provides system administrators with a centralized place to view the status of multiple hosts within the enterprise.
CM-6(a) AC-6(1) | Ensure All World-Writable Directories Are Group Owned by a System Account | All directories in local partitions which are world-writable should be group owned by root or another system account. If any world-writable directories are not group owned by a system account, this should be investigated. Following this, the files should be deleted or assigned to an appropriate group. | Allowing a user account to group own a world-writable directory is undesirable because it allows the owner of that directory to remove or replace any files that may be placed in the directory by other users.
CM-6(a) SC-28 SC-28(1) SC-13 AU-9(3) | Encrypt Partitions | Oracle Linux 7 natively supports partition encryption through the Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to encrypt a partition is during installation time. For manual installations, select the `Encrypt` checkbox during partition creation to encrypt the partition. When this option is selected the system will prompt for a passphrase to use in decrypting the partition. The passphrase will subsequently need to be entered manually every time the system boots. For automated/unattended installations, it is possible to use Kickstart by adding the `--encrypted` and `--passphrase=` options to the definition of each partition to be encrypted. For example, the following line would encrypt the root partition:
    part / --fstype=ext4 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE
Any PASSPHRASE is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly. Omitting the `--passphrase=` option from the partition definition will cause the installer to pause and interactively ask for the passphrase during installation. By default, the `Anaconda` installer uses `aes-xts-plain64` cipher with a minimum `512` bit key size which should be compatible with FIPS enabled. Detailed information on encrypting partitions using LUKS or LUKS ciphers can be found on the Oracle Linux 7 Documentation web site: https://docs.oracle.com/en/operating-systems/oracle-linux/7/security/ol7-install-sec.html. | The risk of a system's physical compromise, particularly mobile systems such as laptops, places its data at risk of compromise. Encrypting this data mitigates the risk of its loss if the system is lost.
CM-6(a) AC-6(1) | Ensure All Files Are Owned by a User | If any files are not owned by a user, then the cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user. The following command will discover and print any files on local partitions which do not belong to a valid user:
    $ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nouser
To search all filesystems on a system including network mounted filesystems the following command can be run manually for each partition:
    $ sudo find PARTITION -xdev -nouser
| Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed.
CM-6(a) IA-5(10) | Enable the SSSD Service | The SSSD service should be enabled. The `sssd` service can be enabled with the following command:
    $ sudo systemctl enable sssd.service
CM-6(a) AC-6(1) | Ensure No World-Writable Files Exist | It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured application or user account. Finally, this applies to real files and not virtual files that are a part of pseudo file systems such as `sysfs` or `procfs`. | Data in world-writable files can be modified by any user on the system. In almost all circumstances, files can be configured using a combination of user and group permissions to support whatever legitimate access is needed without the risk caused by world-writable files.
CM-6(a) AC-17(a) AC-17(2) IA-5(1)(c) SC-13 MA-4(6) | Allow Only SSH Protocol 2 | Only SSH protocol version 2 connections should be permitted. The default setting in `/etc/ssh/sshd_config` is correct, and can be verified by ensuring that the following line appears:
    Protocol 2
| SSH protocol version 1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system.
AC-6 CM-6(a) | Ensure that System Accounts Are Locked | Some accounts are not associated with a human user of the system, and exist to perform some administrative function. An attacker should not be able to log into these accounts. System accounts are those user accounts with a user ID less than UID_MIN, where value of the UID_MIN directive is set in `/etc/login.defs` configuration file. In the default configuration UID_MIN is set to 500, thus system accounts are those user accounts with a user ID less than 500. If any system account SYSACCT (other than root) has an unlocked password, disable it with the command:
    $ sudo passwd -l SYSACCT
| Disabling authentication for default system accounts makes it more difficult for attackers to make use of them to compromise a system.false
CM-6(a) | Install the SSSD Package | The `sssd` package should be installed. The `sssd` package can be installed with the following command:
    $ sudo yum install sssd
CM-6(a) AC-6(1) | Verify User Who Owns /etc/cron.allow file | If `/etc/cron.allow` exists, it must be owned by `root`. To properly set the owner of `/etc/cron.allow`, run the command:
    $ sudo chown root /etc/cron.allow
| If the owner of the cron.allow file is not set to root, the possibility exists for an unauthorized user to view or edit sensitive information.
CM-6(a) AC-6(1) | Enable Kernel Parameter to Enforce DAC on Hardlinks | To set the runtime status of the `fs.protected_hardlinks` kernel parameter, run the following command:
    $ sudo sysctl -w fs.protected_hardlinks=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    fs.protected_hardlinks = 1
| By enabling this kernel parameter, users can no longer create soft or hard links to files which they do not own. Disallowing such hardlinks mitigate vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of `open()` or `creat()`.
CM-6(a) | Ensure Users Cannot Change GNOME3 Session Idle Settings | If not already configured, ensure that users cannot change GNOME3 session idle settings by adding `/org/gnome/desktop/session/idle-delay` to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/session/idle-delay
After the settings have been set, run `dconf update`. | A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the session lock. As such, users should not be allowed to change session settings.
CM-6(a) AC-6(1) AU-9(4) | System Audit Logs Must Have Mode 0640 or Less Permissive | If `log_group` in `/etc/audit/auditd.conf` is set to a group other than the `root` group account, change the mode of the audit log files with the following command:
    $ sudo chmod 0640 audit_file
Otherwise, change the mode of the audit log files with the following command:
    $ sudo chmod 0600 audit_file
| If users can write to audit logs, audit trails can be modified or destroyed.
CM-6(a) AC-7(a) IA-5(4) | Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session | To configure the number of retry prompts that are permitted per-session: Edit the `pam_pwquality.so` statement in `/etc/pam.d/system-auth` to show `retry=`3``, or a lower value if site policy is more restrictive. The DoD requirement is a maximum of 3 prompts per session. | Setting the password retry prompts that are permitted on a per-session basis to a low value requires some software, such as SSH, to re-connect. This can slow down and draw additional attention to some types of password-guessing attacks. Note that this is different from account lockout, which is provided by the pam_faillock module.
CM-6(a) AC-6(1) AU-9(4) | System Audit Logs Must Be Owned By Root | All audit logs must be owned by root user and group. By default, the path for audit log is
    /var/log/audit/
. To properly set the owner of `/var/log/audit`, run the command:
    $ sudo chown root /var/log/audit
To properly set the owner of `/var/log/audit/*`, run the command:
    $ sudo chown root /var/log/audit/*
| Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.
CM-6(a) AU-4 SC-5(2) | Ensure /var/log/audit Located On Separate Partition | Audit logs are stored in the `/var/log/audit` directory. Ensure that `/var/log/audit` has its own partition or logical volume at installation time, or migrate it using LVM. Make absolutely certain that it is large enough to store all audit logs that will be created by the auditing daemon. | Placing `/var/log/audit` in its own partition enables better separation between audit files and other files, and helps ensure that auditing cannot be halted due to the partition running out of space.
CM-6(a) | Install the pcsc-lite package | The `pcsc-lite` package can be installed with the following command:
    $ sudo yum install pcsc-lite
| The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
CM-6(b) | Add noexec Option to /home | The `noexec` mount option can be used to prevent binaries from being executed out of `/home`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`. | The `/home` directory contains data of individual users. Binaries in this directory should not be considered as trusted and users should not be able to execute them.
AC-6 | Disallow kernel profiling by unprivileged users | To set the runtime status of the `kernel.perf_event_paranoid` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.perf_event_paranoid=2
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.perf_event_paranoid = 2
| Kernel profiling can reveal sensitive information about kernel behaviour.
AC-6 CM-6(a) | Restrict Serial Port Root Logins | To restrict root logins on serial ports, ensure lines of this form do not appear in `/etc/securetty`:
    ttyS0
    ttyS1
| Preventing direct root login to serial port interfaces helps ensure accountability for actions taken on the systems using the root account.
CM-6(a) AC-6(1) | Verify User Who Owns gshadow File | To properly set the owner of `/etc/gshadow`, run the command:
    $ sudo chown root /etc/gshadow
| The `/etc/gshadow` file contains group password hashes. Protection of this file is critical for system security.
CM-6(a) | Set the UEFI Boot Loader Admin Username to a Non-Default Value | The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. To maximize the protection, select a password-protected superuser account with unique name, and modify the `/etc/grub.d/01_users` configuration file to reflect the account name change. It is highly suggested not to use common administrator account names like root, admin, or administrator for the grub2 superuser account. Change the superuser to a different username (The default is 'root').
    $ sed -i 's/\(set superuser=\).*/\1"<unique user ID>"/g' /etc/grub.d/01_users
Once the superuser account has been added, update the `grub.cfg` file by running:
    grub2-mkconfig -o /boot/grub2/grub.cfg
| Having a non-default grub superuser username makes password-guessing attacks less effective.
CM-6(a) | Set Boot Loader Password in grub2 | The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. Since plaintext passwords are a security risk, generate a hash for the password by running the following command:
    # grub2-setpassword
When prompted, enter the password that was selected. | Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.
CM-6(a) AC-6(1) | Verify Permissions on shadow File | To properly set the permissions of `/etc/shadow`, run the command:
    $ sudo chmod 0000 /etc/shadow
| The `/etc/shadow` file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.
CM-6(a) AC-6(1) | Verify Group Who Owns passwd File | To properly set the group owner of `/etc/passwd`, run the command:
    $ sudo chgrp root /etc/passwd
| The `/etc/passwd` file contains information about the users that are configured on the system. Protection of this file is critical for system security.
CM-6(b) AC-6 CM-7(a) | Ensure tftp Daemon Uses Secure Mode | If running the `tftp` service is necessary, it should be configured to change its root directory at startup. To do so, ensure `/etc/xinetd.d/tftp` includes `-s` as a command line argument, as shown in the following example:
    server_args = -s /var/lib/tftpboot
| Using the `-s` option causes the TFTP service to only serve files from the given directory. Serving files from an intentionally-specified directory reduces the risk of sharing files which should remain private.
CM-6 | Disable core dump backtraces | The `ProcessSizeMax` option in `[Coredump]` section of `/etc/systemd/coredump.conf` specifies the maximum size in bytes of a core which will be processed. Core dumps exceeding this size may be stored, but the backtrace will not be generated. | A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers or system operators trying to debug problems. Enabling core dumps on production systems is not recommended, however there may be overriding operational requirements to enable advanced debuging. Permitting temporary enablement of core dumps during such situations should be reviewed through local needs and policy.
CM-6(a) IA-5(13) | Configure SSSD's Memory Cache to Expire | SSSD's memory cache should be configured to set to expire records after ``300`` seconds. To configure SSSD to expire memory cache, set `memcache_timeout` to ``300`` under the `[nss]` section in `/etc/sssd/sssd.conf`. For example:
    [nss]
    memcache_timeout = 300
| If cached authentication information is out-of-date, the validity of the authentication information may be questionable.
CM-6(a) SC-8 SC-8(1) SC-8(2) SC-8(3) SC-8(4) | Enable the OpenSSH Service | The SSH server service, sshd, is commonly needed. The `sshd` service can be enabled with the following command:
    $ sudo systemctl enable sshd.service
| Without protection of the transmitted information, confidentiality, and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This checklist item applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, etc). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification.
CM-6(a) CM-6(a) | Ensure that Root's Path Does Not Include World or Group-Writable Directories | For each element in root's path, run:
    # ls -ld DIR
and ensure that write permissions are disabled for group and other. | Such entries increase the risk that root could execute code provided by unprivileged users, and potentially malicious code.
CM-6 | Disable Kernel Image Loading | To set the runtime status of the `kernel.kexec_load_disabled` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.kexec_load_disabled=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.kexec_load_disabled = 1
| Disabling kexec_load allows greater control of the kernel memory. It makes it impossible to load another kernel image after it has been disabled.
CM-6(a) | Install Intrusion Detection Software | The base Oracle Linux 7 platform already includes a sophisticated auditing system that can detect intruder activity, as well as SELinux, which provides host-based intrusion prevention capabilities by confining privileged programs and user sessions which may become compromised. | Host-based intrusion detection tools provide a system-level defense when an intruder gains access to a system or network.
CM-6(a) | Install Virus Scanning Software | Virus scanning software can be used to protect a system from penetration from computer viruses and to limit their spread through intermediate systems. The virus scanning software should be configured to perform scans dynamically on accessed files. If this capability is not available, the system must be configured to scan, at a minimum, all altered files on the system on a daily basis. If the system processes inbound SMTP mail, the virus scanner must be configured to scan all received mail. | Virus scanning software can be used to detect if a system has been compromised by computer viruses, as well as to limit their spread to other systems.
CM-6(d) CM-6(c) SI-7 SI-7(1) SI-7(6) AU-9(3) | Verify and Correct Ownership with RPM | The RPM package management system can check file ownership permissions of installed software packages, including many that are important to system security. After locating a file with incorrect permissions, which can be found with
    rpm -Va | awk '{ if (substr($0,6,1)=="U" || substr($0,7,1)=="G") print $NF }'
run the following command to determine which package owns it:
    $ rpm -qf FILENAME
Next, run the following command to reset its permissions to the correct values:
    $ sudo rpm --setugids PACKAGENAME
| Ownership of binaries and configuration files that is incorrect could allow an unauthorized user to gain privileges that they should not have. The ownership set by the vendor should be maintained. Any deviations from this baseline should be investigated.
CM-6(a) CM-6(a) | Ensure that Root's Path Does Not Include Relative Paths or Null Directories | Ensure that none of the directories in root's path is equal to a single `.` character, or that it contains any instances that lead to relative path traversal, such as `..` or beginning a path without the slash (`/`) character. Also ensure that there are no "empty" elements in the path, such as in these examples:
    PATH=:/bin
    PATH=/bin:
    PATH=/bin::/sbin
These empty elements have the same effect as a single `.` character. | Including these entries increases the risk that root could execute code from an untrusted location.
CM-6(a) | Enable cron Service | The `crond` service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary maintenance tasks, such as notifying root of system activity. The `cron` service can be enabled with the following command:
    $ sudo systemctl enable cron.service
| Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential.
CM-6(a) AC-6(1) | Verify Group Who Owns shadow File | To properly set the group owner of `/etc/shadow`, run the command:
    $ sudo chgrp root /etc/shadow
| The `/etc/shadow` file stores password hashes. Protection of this file is critical for system security.
CM-6 | Disable storing core dump | The `Storage` option in `[Coredump]` section of `/etc/systemd/coredump.conf` can be set to `none` to disable storing core dumps permanently. | A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers or system operators trying to debug problems. Enabling core dumps on production systems is not recommended, however there may be overriding operational requirements to enable advanced debuging. Permitting temporary enablement of core dumps during such situations should be reviewed through local needs and policy.
CM-6(a) | Install AIDE | The `aide` package can be installed with the following command:
    $ sudo yum install aide
| The AIDE package must be installed if it is to be available for integrity checking.
CM-6(a) AC-6(1) | Verify Permissions on group File | To properly set the permissions of `/etc/passwd`, run the command:
    $ sudo chmod 0644 /etc/passwd
| The `/etc/group` file contains information regarding groups that are configured on the system. Protection of this file is important for system security.
CM-6(a) | Install the opensc Package For Multifactor Authentication | The `opensc` package can be installed with the following command:
    $ sudo yum install opensc
| Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.
CM-6(a) AC-6(1) | Ensure All SGID Executables Are Authorized | The SGID (set group id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthorized SGID files is determine if any were not installed as part of an RPM package, which is cryptographically verified. Investigate the origin of any unpackaged SGID files. This configuration check considers authorized SGID files which were installed via RPM. It is assumed that when an individual has sudo access to install an RPM and all packages are signed with an organizationally-recognized GPG key, the software should be considered an approved package on the system. Any SGID file not deployed through an RPM will be flagged for further review. | Executable files with the SGID permission run with the privileges of the owner of the file. SGID files of uncertain provenance could allow for unprivileged users to elevate privileges. The presence of these files should be strictly controlled on the system.
CM-6(a) | Install the Asset Configuration Compliance Module (ACCM) | Install the Asset Configuration Compliance Module (ACCM). | Without a host-based intrusion detection tool, there is no system-level defense when an intruder gains access to a system or network. Additionally, a host-based intrusion prevention tool can provide methods to immediately lock out detected intrusion attempts.
AC-6(1) CM-6(a) | Ensure the Default Bash Umask is Set Correctly | To ensure the default umask for users of the Bash shell is set properly, add or correct the `umask` setting in `/etc/bashrc` to read as follows:
    umask 027
| The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.
AC-6(1) CM-6(a) | Ensure the Default Umask is Set Correctly in login.defs | To ensure the default umask controlled by `/etc/login.defs` is set properly, add or correct the `UMASK` setting in `/etc/login.defs` to read as follows:
    UMASK 027
| The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read and written to by unauthorized users.
AC-6(1) CM-6(a) | Ensure the Default Umask is Set Correctly in /etc/profile | To ensure the default umask controlled by `/etc/profile` is set properly, add or correct the `umask` setting in `/etc/profile` to read as follows:
    umask 027
| The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.
AC-6(1) CM-6(a) | Ensure the Default C Shell Umask is Set Correctly | To ensure the default umask for users of the C shell is set properly, add or correct the `umask` setting in `/etc/csh.cshrc` to read as follows:
    umask 027
| The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.
AC-6(2) AC-17(a) IA-2 IA-2(5) CM-7(a) CM-7(b) CM-6(a) | Disable SSH Root Login | The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line in `/etc/ssh/sshd_config`:
    PermitRootLogin no
| Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account provides individual accountability of actions performed on the system and also helps to minimize direct attack attempts on root's password.
AC-6(9) CM-6(a) | Make the auditd Configuration Immutable | If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to make the auditd configuration immutable:
    -e 2
If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file in order to make the auditd configuration immutable:
    -e 2
With this setting, a reboot will be required to change any audit rules. | Making the audit configuration immutable prevents accidental as well as malicious modification of the audit rules, although it may be problematic if legitimate changes are needed during system operation
CM-7(a) CM-7(b) CM-6(a) SC-7(a) | Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.default.accept_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.accept_redirects = 0
| ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nosuid Option to /var/log/audit | The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/log/audit`. The SUID and SGID permissions should not be required in directories containing audit log files. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`. | The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from partitions designated for audit log files.
CM-7(a) CM-7(b) CM-6(a) | Disable IPv6 Addressing on All IPv6 Interfaces | To disable support for (`ipv6`) addressing on all interface add the following line to `/etc/sysctl.d/ipv6.conf` (or another file in `/etc/sysctl.d`):
    net.ipv6.conf.all.disable_ipv6 = 1
This disables IPv6 on all network interfaces as other services and system functionality require the IPv6 stack loaded to work. | Any unnecessary network stacks - including IPv6 - should be disabled, to reduce the vulnerability to exploitation.
CM-7(a) CM-7(b) CM-6(a) | Disable DCCP Support | The Datagram Congestion Control Protocol (DCCP) is a relatively new transport layer protocol, designed to support streaming media and telephony. To configure the system to prevent the `dccp` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install dccp /bin/true
| Disabling DCCP protects the system against exploitation of any flaws in its implementation.
CM-7(a) CM-7(b) CM-6(a) | Configure Accepting Router Advertisements on All IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.accept_ra` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.accept_ra=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.accept_ra = 0
| An illicit router advertisement message could result in a man-in-the-middle attack.
CM-7(a) CM-7(b) CM-6(a) | Uninstall the telnet server | The telnet daemon should be uninstalled. | `telnet` allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.'
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nodev Option to Non-Root Local Partitions | The `nodev` mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of any non-root local partitions. | The `nodev` mount option prevents files from being interpreted as character or block devices. The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails, for which it is not advised to set `nodev` on these filesystems.
CM-7(a) CM-7(b) CM-6(a) | Disable GNOME3 Automount running | The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable autorun-never within GNOME3, add or set `autorun-never` to `true` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/media-handling]
    autorun-never=true
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/media-handling/autorun-never
After the settings have been set, run `dconf update`. | Disabling automatic mount running in GNOME3 can prevent the introduction of malware via removable media. It will, however, also prevent desktop users from legitimate use of removable media.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nosuid Option to /dev/shm | The `nosuid` mount option can be used to prevent execution of setuid programs in `/dev/shm`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`. | The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nosuid Option to /boot | The `nosuid` mount option can be used to prevent execution of setuid programs in `/boot`. The SUID and SGID permissions should not be required on the boot partition. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot`. | The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from boot partitions.
CM-7(a) CM-7(b) CM-6(a) | Uninstall the ssl compliant telnet server | The `telnet` daemon, even with ssl support, should be uninstalled. | `telnet`, even with ssl support, should not be installed. When remote shell is required, up-to-date ssh daemon can be used.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nosuid Option to /tmp | The `nosuid` mount option can be used to prevent execution of setuid programs in `/tmp`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`. | The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.
CM-7(a) CM-7(b) CM-6(a) CM-7(2) MA-3 | Ensure System is Not Acting as a Network Sniffer | The system should not be acting as a network sniffer, which can capture all traffic on the network to which it is connected. Run the following to determine if any interface is running in promiscuous mode:
    $ ip link | grep PROMISC
Promiscuous mode of an interface can be disabled with the following command:
    $ sudo ip link set dev device_name multicast off promisc off
| Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system. If unauthorized individuals can access these applications, it may allow them to collect information such as logon IDs, passwords, and key exchanges between systems. If the system is being used to perform a network troubleshooting function, the use of these tools must be documented with the Information Systems Security Manager (ISSM) and restricted to only authorized personnel.
CM-7(a) CM-7(b) SC-5(1) SC-5(2) SC-5(3)(a) CM-6(a) | Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces | To set the runtime status of the `net.ipv4.tcp_syncookies` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.tcp_syncookies=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.tcp_syncookies = 1
| A TCP SYN flood attack can cause a denial of service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies can be used to track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This feature is activated when a flood condition is detected, and enables the system to continue servicing valid connection requests.
CM-7(a) CM-7(b) CM-6(a) | Disable xinetd Service | The `xinetd` service can be disabled with the following command:
    $ sudo systemctl mask --now xinetd.service
| The xinetd service provides a dedicated listener service for some programs, which is no longer necessary for commonly-used network services. Disabling it ensures that these uncommon services are not running, and also prevents attacks against xinetd itself.
CM-7(a) CM-7(b) CM-6(a) IA-5(1)(c) | Disable rexec Service | The `rexec` service, which is available with the `rsh-server` package and runs as a service through xinetd or separately as a systemd socket, should be disabled. If using xinetd, set `disable` to `yes` in `/etc/xinetd.d/rexec`. The `rexec` socket can be disabled with the following command:
    $ sudo systemctl mask --now rexec.socket
| The rexec service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network.
CM-7(a) CM-7(b) SC-5 | Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces | To set the runtime status of the `net.ipv4.icmp_ignore_bogus_error_responses` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.icmp_ignore_bogus_error_responses = 1
| Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged.
CM-7(a) CM-7(b) CM-6(a) | Remove the X Windows Package Group | By removing the xorg-x11-server-common package, the system no longer has X Windows installed. If X Windows is not installed then the system cannot boot into graphical user mode. This prevents the system from being accidentally or maliciously booted into a `graphical.target` mode. To do so, run the following command:
    $ sudo yum groupremove "X Window System"
    $ sudo yum remove xorg-x11-server-common
| Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security vulnerabilities and should not be installed unless approved and documented.
CM-7(a) CM-7(b) CM-6(a) | Disable SCTP Support | The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. To configure the system to prevent the `sctp` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install sctp /bin/true
| Disabling SCTP protects the system against exploitation of any flaws in its implementation.
CM-7(a) CM-7(b) CM-6(a) IA-5(1)(c) | Uninstall rsh-server Package | The `rsh-server` package can be removed with the following command:
    $ sudo yum erase rsh-server
| The `rsh-server` service provides unencrypted remote access service which does not provide for the confidentiality and integrity of user passwords or the remote session and has very weak authentication. If a privileged user were to login using this service, the privileged user password could be compromised. The `rsh-server` package provides several obsolete and insecure network services. Removing it decreases the risk of those services' accidental (or intentional) activation.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nodev Option to /var | The `nodev` mount option can be used to prevent device files from being created in `/var`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CM-7(a) CM-7(b) CM-6(a) SC-7(a) | Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.secure_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.secure_redirects = 0
| Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.
CM-7(a) CM-7(b) CM-6(a) | Uninstall Sendmail Package | Sendmail is not the default mail transfer agent and is not installed by default. The `sendmail` package can be removed with the following command:
    $ sudo yum erase sendmail
| The sendmail software was not developed with security in mind and its design prevents it from being effectively contained by SELinux. Postfix should be used instead.
CM-7(a) CM-7(b) CM-6(a) SC-7(a) | Disable Accepting ICMP Redirects for All IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.accept_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.accept_redirects = 0
| ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required."
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add noexec Option to /var/log | The `noexec` mount option can be used to prevent binaries from being executed out of `/var/log`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`. | Allowing users to execute binaries from directories containing log files such as `/var/log` should never be necessary in normal operation and can expose the system to potential compromise.
CM-7(a) CM-7(b) SC-5 SC-7(a) | Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default | To set the runtime status of the `net.ipv4.conf.default.accept_source_route` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.accept_source_route = 0
| Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required, such as when IPv4 forwarding is enabled and the system is legitimately functioning as a router.
CM-7(a) CM-7(b) CM-6(a) | Disable Odd Job Daemon (oddjobd) | The `oddjobd` service exists to provide an interface and access control mechanism through which specified privileged tasks can run tasks for unprivileged client applications. Communication with `oddjobd` through the system message bus. The `oddjobd` service can be disabled with the following command:
    $ sudo systemctl mask --now oddjobd.service
| The `oddjobd` service may provide necessary functionality in some environments, and can be disabled if it is not needed. Execution of tasks by privileged programs, on behalf of unprivileged ones, has traditionally been a source of privilege escalation security issues.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nosuid Option to /home | The `nosuid` mount option can be used to prevent execution of setuid programs in `/home`. The SUID and SGID permissions should not be required in these user data directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`. | The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from user home directory partitions.
CM-7(a) CM-7(b) CM-6(a) | Disable TIPC Support | The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communications between nodes in a cluster. To configure the system to prevent the `tipc` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install tipc /bin/true
| Disabling TIPC protects the system against exploitation of any flaws in its implementation.
CM-7(a) CM-7(b) SC-5 CM-6(a) SC-7(a) | Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.accept_source_route` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.accept_source_route = 0
| Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.
SI-7 SI-7(1) CM-6(a) | Configure Periodic Execution of AIDE | At a minimum, AIDE should be configured to run a weekly scan. To implement a daily execution of AIDE at 4:05am using cron, add the following line to `/etc/crontab`:
    05 4 * * * root  --check
To implement a weekly execution of AIDE at 4:05am using cron, add the following line to `/etc/crontab`:
    05 4 * * 0 root  --check
AIDE can be executed periodically through other means; this is merely one example. The usage of cron's special time codes, such as `@daily` and `@weekly` is acceptable. | By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files. Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security. Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.
CM-7(a) CM-7(b) CM-6(a) | Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server | The `rsyslog` daemon should not accept remote messages unless the system acts as a log server. To ensure that it is not listening on the network, ensure the following lines are not found in `/etc/rsyslog.conf`:
    $ModLoad imtcp
    $InputTCPServerRun port
    $ModLoad imudp
    $UDPServerRun port
    $ModLoad imrelp
    $InputRELPServerRun port
| Any process which receives messages from the network incurs some risk of receiving malicious messages. This risk can be eliminated for rsyslog by configuring it not to listen on the network.
CM-7(a) CM-7(b) CM-6(a) | Disable IPv6 Addressing on IPv6 Interfaces by Default | To disable support for (`ipv6`) addressing on interfaces by default add the following line to `/etc/sysctl.d/ipv6.conf` (or another file in `/etc/sysctl.d`):
    net.ipv6.conf.default.disable_ipv6 = 1
This disables IPv6 on network interfaces by default as other services and system functionality require the IPv6 stack loaded to work. | Any unnecessary network stacks - including IPv6 - should be disabled, to reduce the vulnerability to exploitation.
CM-7(a) CM-7(b) CM-6(a) | Disable Avahi Server Software | The `avahi-daemon` service can be disabled with the following command:
    $ sudo systemctl mask --now avahi-daemon.service
| Because the Avahi daemon service keeps an open network port, it is subject to network attacks. Its functionality is convenient but is only appropriate if the local network can be trusted.
CM-7(a) CM-7(b) SC-5 | Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces | To set the runtime status of the `net.ipv4.icmp_echo_ignore_broadcasts` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.icmp_echo_ignore_broadcasts = 1
| Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks. Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network.
CM-7(a) CM-7(b) CM-6(a) IA-5(1)(c) | Disable ypbind Service | The `ypbind` service, which allows the system to act as a client in a NIS or NIS+ domain, should be disabled. The `ypbind` service can be disabled with the following command:
    $ sudo systemctl mask --now ypbind.service
| Disabling the `ypbind` service ensures the system is not acting as a client in a NIS or NIS+ domain. This service should be disabled unless in use.
CM-7(a) CM-6(a) | Disable Automatic Bug Reporting Tool (abrtd) | The Automatic Bug Reporting Tool (`abrtd`) daemon collects and reports crash data when an application crash is detected. Using a variety of plugins, abrtd can email crash reports to system administrators, log crash reports to files, or forward crash reports to a centralized issue tracking system such as RHTSupport. The `abrtd` service can be disabled with the following command:
    $ sudo systemctl mask --now abrtd.service
| Mishandling crash data could expose sensitive information about vulnerabilities in software executing on the system, as well as sensitive information from within a process's address space or registers.
CM-7(a) CM-7(b) CM-6(a) | Minimize Served Information | Edit /etc/dhcp/dhcpd.conf. Examine each address range section within the file, and ensure that the following options are not defined unless there is an operational need to provide this information via DHCP:
    option domain-name
    option domain-name-servers
    option nis-domain
    option nis-servers
    option ntp-servers
    option routers
    option time-offset
| Because the configuration information provided by the DHCP server could be maliciously provided to clients by a rogue DHCP server, the amount of information provided via DHCP should be minimized. Remove these definitions from the DHCP server configuration to ensure that legitimate clients do not unnecessarily rely on DHCP for this information.
CM-7(a) CM-7(b) CM-6(a) AC-3(3)(a) AC-6 | Ensure No Daemons are Unconfined by SELinux | Daemons for which the SELinux policy does not contain rules will inherit the context of the parent process. Because daemons are launched during startup and descend from the `init` process, they inherit the `unconfined_service_t` context. To check for unconfined daemons, run the following command:
    $ sudo ps -eZ | grep "unconfined_service_t"
It should produce no output in a well-configured system. | Daemons which run with the `unconfined_service_t` context may cause AVC denials, or allow privileges that the daemon does not require.
CM-7(a) CM-7(b) CM-6(a) | Disable Mounting of cramfs | To configure the system to prevent the `cramfs` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install cramfs /bin/true
This effectively prevents usage of this uncommon filesystem. The `cramfs` filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A `cramfs` image can be used without having to first decompress the image. | Removing support for unneeded filesystem types reduces the local attack surface of the server.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nodev Option to /tmp | The `nodev` mount option can be used to prevent device files from being created in `/tmp`. Legitimate character and block devices should not exist within temporary directories like `/tmp`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CM-7(a) CM-7(b) CM-6(a) IA-5(1)(c) | Disable rsh Service | The `rsh` service, which is available with the `rsh-server` package and runs as a service through xinetd or separately as a systemd socket, should be disabled. If using xinetd, set `disable` to `yes` in `/etc/xinetd.d/rsh`. The `rsh` socket can be disabled with the following command:
    $ sudo systemctl mask --now rsh.socket
| The rsh service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nosuid Option to /var/log | The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/log`. The SUID and SGID permissions should not be required in directories containing log files. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`. | The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from partitions designated for log files.
CM-7(a) CM-7(b) CM-6(a) IA-5(1)(c) IA-5(1).1(v) CM-7 CM-7.1(ii) | Uninstall vsftpd Package | The `vsftpd` package can be removed with the following command:
     $ sudo yum erase vsftpd
| Removing the `vsftpd` package decreases the risk of its accidental activation.
CM-7(a) CM-7(b) CM-6(a) | Disable GNOME3 Automount Opening | The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable automount-open within GNOME3, add or set `automount-open` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/media-handling]
    automount-open=false
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/media-handling/automount-open
After the settings have been set, run `dconf update`. | Disabling automatic mounting in GNOME3 can prevent the introduction of malware via removable media. It will, however, also prevent desktop users from legitimate use of removable media.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add noexec Option to /var/log/audit | The `noexec` mount option can be used to prevent binaries from being executed out of `/var/log/audit`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`. | Allowing users to execute binaries from directories containing audit log files such as `/var/log/audit` should never be necessary in normal operation and can expose the system to potential compromise.
CM-7(a) CM-7(b) SC-5(3)(a) | Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.log_martians` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.log_martians=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.log_martians = 1
| The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.
CM-7(a) CM-7(b) CM-6(a) | Disable RDS Support | The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide reliable high-bandwidth, low-latency communications between nodes in a cluster. To configure the system to prevent the `rds` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install rds /bin/true
| Disabling RDS protects the system against exploitation of any flaws in its implementation.
CM-7(a) CM-7(b) CM-6(a) | Uninstall xinetd Package | The `xinetd` package can be removed with the following command:
    $ sudo yum erase xinetd
| Removing the `xinetd` package decreases the risk of the xinetd service's accidental (or intentional) activation.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nodev Option to /dev/shm | The `nodev` mount option can be used to prevent creation of device files in `/dev/shm`. Legitimate character and block devices should not exist within temporary directories like `/dev/shm`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CM-7(a) CM-7(b) CM-6(a) CM-6(b) CM-6.1(iv) | Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default | To set the runtime status of the `net.ipv6.conf.default.accept_source_route` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.accept_source_route = 0
| Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required.
CM-7(a) CM-7(b) CM-6(a) CM-6(b) CM-6.1(iv) | Disable Accepting ICMP Redirects for All IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.accept_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.accept_redirects = 0
| An illicit ICMP redirect message could result in a man-in-the-middle attack.
CM-7(a) CM-7(b) CM-6(a) | Disable Accepting Router Advertisements on all IPv6 Interfaces by Default | To set the runtime status of the `net.ipv6.conf.default.accept_ra` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.accept_ra=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.accept_ra = 0
| An illicit router advertisement message could result in a man-in-the-middle attack.
CM-7(a) CM-7(b) CM-6(a) IA-5(1)(c) | Disable telnet Service | The `telnet` service configuration file `/etc/xinetd.d/telnet` is not created automatically. If it was created manually, check the `/etc/xinetd.d/telnet` file and ensure that `disable = no` is changed to read `disable = yes` as follows below:
    # description: The telnet server serves telnet sessions; it uses \\
    #       unencrypted username/password pairs for authentication.
    service telnet
    {
            flags           = REUSE
            socket_type     = stream

            wait            = no
            user            = root
            server          = /usr/sbin/in.telnetd
            log_on_failure  += USERID
            disable         = yes
    }
If the `/etc/xinetd.d/telnet` file does not exist, make sure that the activation of the `telnet` service on system boot is disabled via the following command: The `rexec` socket can be disabled with the following command:
    $ sudo systemctl mask --now rexec.socket
| The telnet protocol uses unencrypted network communication, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. The telnet protocol is also subject to man-in-the-middle attacks.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add noexec Option to /dev/shm | The `noexec` mount option can be used to prevent binaries from being executed out of `/dev/shm`. It can be dangerous to allow the execution of binaries from world-writable temporary storage directories such as `/dev/shm`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`. | Allowing users to execute binaries from world-writable directories such as `/dev/shm` can expose the system to potential compromise.
CM-7(a) CM-7(b) CM-6(a) IA-5(1)(c) | Disable rlogin Service | The `rlogin` service, which is available with the `rsh-server` package and runs as a service through xinetd or separately as a systemd socket, should be disabled. If using xinetd, set `disable` to `yes` in `/etc/xinetd.d/rlogin`. The `rlogin` socket can be disabled with the following command:
    $ sudo systemctl mask --now rlogin.socket
| The rlogin service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network.
CM-7(a) CM-7(b) CM-6(a) | Disable X Windows Startup By Setting Default Target | Systems that do not require a graphical user interface should only boot by default into `multi-user.target` mode. This prevents accidental booting of the system into a `graphical.target` mode. Setting the system's default target to `multi-user.target` will prevent automatic startup of the X server. To do so, run:
    $ systemctl set-default multi-user.target
You should see the following output:
    Removed symlink /etc/systemd/system/default.target.
    Created symlink from /etc/systemd/system/default.target to /usr/lib/systemd/system/multi-user.target.
| Services that are not required for system and application processes must not be active to decrease the attack surface of the system. X windows has a long history of security vulnerabilities and should not be used unless approved and documented.
CM-7(a) CM-7(b) CM-6(a) | Disable IPv6 Networking Support Automatic Loading | To prevent the IPv6 kernel module (`ipv6`) from binding to the IPv6 networking stack, add the following line to `/etc/modprobe.d/disabled.conf` (or another file in `/etc/modprobe.d`):
    options ipv6 disable=1
This permits the IPv6 module to be loaded (and thus satisfy other modules that depend on it), while disabling support for the IPv6 protocol. | Any unnecessary network stacks - including IPv6 - should be disabled, to reduce the vulnerability to exploitation.
CM-7(a) CM-7(b) CM-6(a) | Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.default.accept_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.default.accept_redirects = 0
| An illicit ICMP redirect message could result in a man-in-the-middle attack.
CM-7(a) CM-7(b) CM-6(a) | Disable GNOME3 Automounting | The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable automount within GNOME3, add or set `automount` to `false` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/media-handling]
    automount=false
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/media-handling/automount
After the settings have been set, run `dconf update`. | Disabling automatic mounting in GNOME3 can prevent the introduction of malware via removable media. It will, however, also prevent desktop users from legitimate use of removable media.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nodev Option to /var/log | The `nodev` mount option can be used to prevent device files from being created in `/var/log`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CM-7(a) CM-7(b) SC-5 CM-6(a) SC-7(a) | Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces | To set the runtime status of the `net.ipv4.ip_forward` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.ip_forward=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.ip_forward = 0
| Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this capability is used when not required, system network information may be unnecessarily transmitted across the network.
CM-7(a) CM-7(b) CM-6(a) | Uninstall quagga Package | The `quagga` package can be removed with the following command:
     $ sudo yum erase quagga
| Routing software is typically used on routers to exchange network topology information with other routers. If routing software is used when not required, system network information may be unnecessarily transmitted across the network. If there is no need to make the router software available, removing it provides a safeguard against its activation.
SI-7 SI-7(1) CM-6(a) | Configure AIDE to Use FIPS 140-2 for Validating Hashes | By default, the `sha512` option is added to the `NORMAL` ruleset in AIDE. If using a custom ruleset or the `sha512` option is missing, add `sha512` to the appropriate ruleset. For example, add `sha512` to the following line in `/etc/aide.conf`:
    NORMAL = FIPSR+sha512
AIDE rules can be configured in multiple ways; this is merely one example that is already configured by default. | File integrity tools use cryptographic hashes for verifying file contents and directories have not been altered. These hashes must be FIPS 140-2 approved cryptographic hashes.
CM-7(a) CM-7(b) CM-6(a) | Disable Apache Qpid (qpidd) | The `qpidd` service provides high speed, secure, guaranteed delivery services. It is an implementation of the Advanced Message Queuing Protocol. By default the qpidd service will bind to port 5672 and listen for connection attempts. The `qpidd` service can be disabled with the following command:
    $ sudo systemctl mask --now qpidd.service
| The qpidd service is automatically installed when the `base` package selection is selected during installation. The qpidd service listens for network connections, which increases the attack surface of the system. If the system is not intended to receive AMQP traffic, then the `qpidd` service is not needed and should be disabled or removed.
CM-7(a) CM-7(b) CM-6(a) IA-2 IA-2(8) IA-2(9) AC-17(a) | Use Kerberos Security on All Exports | Using Kerberos on all exported mounts prevents a malicious client or user from impersonating a system user. To cryptography authenticate users to the NFS server, add `sec=krb5:krb5i:krb5p` to each export in `/etc/exports`. | When an NFS server is configured to use AUTH_SYS a selected userid and groupid are used to handle requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The AUTH_GSS method of authentication uses certificates on the server and client systems to more securely authenticate the remote mount request.
SI-7 SI-7(1) CM-6(a) | Configure AIDE to Verify Extended Attributes | By default, the `xattrs` option is added to the `FIPSR` ruleset in AIDE. If using a custom ruleset or the `xattrs` option is missing, add `xattrs` to the appropriate ruleset. For example, add `xattrs` to the following line in `/etc/aide.conf`:
    FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256
AIDE rules can be configured in multiple ways; this is merely one example that is already configured by default. The remediation provided with this rule adds `xattrs` to all rule sets available in `/etc/aide.conf` | Extended attributes in file systems are used to contain arbitrary data and file metadata with security implications.
CM-7(a) CM-7(b) CM-6(a) IA-2 IA-2(8) IA-2(9) AC-17(a) | Mount Remote Filesystems with Kerberos Security | Add the `sec=krb5:krb5i:krb5p` option to the fourth column of `/etc/fstab` for the line which controls mounting of any NFS mounts. | When an NFS server is configured to use AUTH_SYS a selected userid and groupid are used to handle requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The AUTH_GSS method of authentication uses certificates on the server and client systems to more securely authenticate the remote mount request.
CM-7(a) CM-7(b) CM-6(a) IA-2 | Disable GDM Guest Login | The GNOME Display Manager (GDM) can allow users to login without credentials which can be useful for public kiosk scenarios. Allowing users to login without credentials or "guest" account access has inherent security risks and should be disabled. To do disable timed logins or guest account access, set the `TimedLoginEnable` to `false` in the `[daemon]` section in `/etc/gdm/custom.conf`. For example:
    [daemon]
    TimedLoginEnable=false
| Failure to restrict system access to authenticated users negatively impacts operating system security.
CM-7(a) CM-7(b) CM-6(a) | Disable At Service (atd) | The `at` and `batch` commands can be used to schedule tasks that are meant to be executed only once. This allows delayed execution in a manner similar to cron, except that it is not recurring. The daemon `atd` keeps track of tasks scheduled via `at` and `batch`, and executes them at the specified time. The `atd` service can be disabled with the following command:
    $ sudo systemctl mask --now atd.service
| The `atd` service could be used by an unsophisticated insider to carry out activities outside of a normal login session, which could complicate accountability. Furthermore, the need to schedule tasks with `at` or `batch` is not common.
CM-7(a) CM-7(b) CM-6(a) | Uninstall bind Package | The `named` service is provided by the `bind` package. The `bind` package can be removed with the following command:
    $ sudo yum erase bind
| If there is no need to make DNS server software available, removing it provides a safeguard against its activation.
CM-7(a) CM-7(b) CM-6(a) | Configure SSSD LDAP Backend to Use TLS For All Transactions | The LDAP client should be configured to implement TLS for the integrity of all remote LDAP authentication sessions. If the `id_provider` is set to `ldap` or `ipa` in `/etc/sssd/sssd.conf` or any of the `/etc/sssd/sssd.conf.d` configuration files, `ldap_id_use_start_tls` must be set to `true`. To check if LDAP is configured to use TLS when `id_provider` is set to `ldap` or `ipa`, use the following command:
    $ sudo grep -i ldap_id_use_start_tls /etc/sssd/sssd.conf
| Without cryptographic integrity protections, information can be altered by unauthorized users without detection. The ssl directive specifies whether to use TLS or not. If not specified it will default to no. It should be set to start_tls rather than doing LDAP over SSL.
CM-7(a) CM-7(b) CM-6(a) AC-3(3)(a) AC-6 | Ensure No Device Files are Unlabeled by SELinux | Device files, which are used for communication with important system resources, should be labeled with proper SELinux types. If any device files carry the SELinux type `device_t` or `unlabeled_t`, report the bug so that policy can be corrected. Supply information about what the device is and what programs use it. To check for incorrectly labeled device files, run following commands:
    $ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"
    $ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"
It should produce no output in a well-configured system. | If a device file carries the SELinux type `device_t` or `unlabeled_t`, then SELinux cannot properly restrict access to the device file.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nodev Option to /var/log/audit | The `nodev` mount option can be used to prevent device files from being created in `/var/log/audit`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/log/audit`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nosuid Option to Removable Media Partitions | The `nosuid` mount option prevents set-user-identifier (SUID) and set-group-identifier (SGID) permissions from taking effect. These permissions allow users to execute binaries with the same permissions as the owner and group of the file respectively. Users should not be allowed to introduce SUID and SGID files into the system via partitions mounted from removeable media. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of any removable media partitions. | The presence of SUID and SGID executables should be tightly controlled. Allowing users to introduce SUID or SGID binaries from partitions mounted off of removable media would allow them to introduce their own highly-privileged programs.
AC-7(a) AU-7(1) AU-7(2) AU-14 AU-12(2) AU-2(a) CM-6(a) | Ensure the audit Subsystem is Installed | The audit package should be installed. | The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
CM-7(a) CM-7(b) CM-6(a) SC-7(a) | Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.rp_filter` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.rp_filter=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.rp_filter = 1
| Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.
CM-7(a) | Disable vsyscalls | To disable use of virtual syscalls, add the argument `vsyscall=none` to the default GRUB 2 command line for the Linux operating system. To ensure that `vsyscall=none` is added as a kernel command line argument to newly installed kernels, ad `vsyscall=none` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... vsyscall=none ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="vsyscall=none"
| Virtual Syscalls provide an opportunity of attack for a user who has control of the return instruction pointer.
CM-7(a) CM-7(b) CM-6(a) | Uninstall tftp-server Package | The `tftp-server` package can be removed with the following command:
     $ sudo yum erase tftp-server
| Removing the `tftp-server` package decreases the risk of the accidental (or intentional) activation of tftp services. If TFTP is required for operational support (such as transmission of router configurations), its use must be documented with the Information Systems Securty Manager (ISSM), restricted to only authorized personnel, and have access control rules established.
CM-7(a) CM-7(b) CM-6(a) | Uninstall DHCP Server Package | If the system does not need to act as a DHCP server, the dhcp package can be uninstalled. The `dhcp` package can be removed with the following command:
    $ sudo yum erase dhcp
| Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
CM-7(a) CM-7(b) SC-5 SC-7(a) | Configure Kernel Parameter for Accepting Secure Redirects By Default | To set the runtime status of the `net.ipv4.conf.default.secure_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.secure_redirects = 0
| Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.
AC-7(b) CM-6(a) | Ensure the Logon Failure Delay is Set Correctly in login.defs | To ensure the logon failure delay controlled by `/etc/login.defs` is set properly, add or correct the `FAIL_DELAY` setting in `/etc/login.defs` to read as follows:
    FAIL_DELAY 4
| Increasing the time between a failed authentication attempt and re-prompting to enter credentials helps to slow a single-threaded brute force attack.
CM-7(a) CM-7(b) SC-5 CM-6(a) SC-7(a) | Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces | To set the runtime status of the `net.ipv4.conf.all.send_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.all.send_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.all.send_redirects = 0
| ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nodev Option to Removable Media Partitions | The `nodev` mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of any removable media partitions. | The only legitimate location for device files is the `/dev` directory located on the root partition. An exception to this is chroot jails, and it is not advised to set `nodev` on partitions which contain their root filesystems.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add noexec Option to Removable Media Partitions | The `noexec` mount option prevents the direct execution of binaries on the mounted filesystem. Preventing the direct execution of binaries from removable media (such as a USB key) provides a defense against malicious software that may be present on such untrusted media. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of any removable media partitions. | Allowing users to execute binaries from removable media such as USB keys exposes the system to potential compromise.
CM-7(a) CM-7(b) CM-6(a) MP-7 | Disable the Automounter | The `autofs` daemon mounts and unmounts filesystems, such as user home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default configuration provides the cdrom device as `/misc/cd`. However, this method of providing access to removable media is not common, so autofs can almost always be disabled if NFS is not in use. Even if NFS is required, it may be possible to configure filesystem mounts statically by editing `/etc/fstab` rather than relying on the automounter. The `autofs` service can be disabled with the following command:
    $ sudo systemctl mask --now autofs.service
| Disabling the automounter permits the administrator to statically control filesystem mounting through `/etc/fstab`. Additionally, automatically mounting filesystems permits easy introduction of unknown devices, thereby facilitating malicious activity.
CM-7(a) CM-7(b) CM-6(a) | Uninstall the inet-based telnet server | The inet-based telnet daemon should be uninstalled. | `telnet` allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add noexec Option to /tmp | The `noexec` mount option can be used to prevent binaries from being executed out of `/tmp`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`. | Allowing users to execute binaries from world-writable directories such as `/tmp` should never be necessary in normal operation and can expose the system to potential compromise.
CM-7(a) CM-7(b) CM-6(a) SC-7(a) | Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default | To set the runtime status of the `net.ipv4.conf.default.rp_filter` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.rp_filter=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.rp_filter = 1
| Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.
CM-7(a) CM-7(b) CM-6(a) | Disable KDump Kernel Crash Analyzer (kdump) | The `kdump` service provides a kernel crash dump analyzer. It uses the `kexec` system call to boot a secondary kernel ("capture" kernel) following a system crash, which can load information from the crashed kernel for analysis. The `kdump` service can be disabled with the following command:
    $ sudo systemctl mask --now kdump.service
| Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps consume a considerable amount of disk space and may result in denial of service by exhausting the available space on the target file system partition. Unless the system is used for kernel development or testing, there is little need to run the kdump service.
CM-7(a) CM-7(b) CM-6(a) | Uninstall telnet-server Package | The `telnet-server` package can be removed with the following command:
    $ sudo yum erase telnet-server
| It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities are often overlooked and therefore may remain unsecure. They increase the risk to the platform by providing additional attack vectors. The telnet service provides an unencrypted remote access service which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to login using this service, the privileged user password could be compromised. Removing the `telnet-server` package decreases the risk of the telnet service's accidental (or intentional) activation.
CM-7(a) CM-7(b) SC-5 CM-6(a) SC-7(a) | Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default | To set the runtime status of the `net.ipv4.conf.default.send_redirects` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.send_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.send_redirects = 0
| ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.
CM-7(a) CM-7(b) SC-5(3)(a) | Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default | To set the runtime status of the `net.ipv4.conf.default.log_martians` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv4.conf.default.log_martians=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv4.conf.default.log_martians = 1
| The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.
SI-7 SI-7(1) CM-6(a) | Configure AIDE to Verify Access Control Lists (ACLs) | By default, the `acl` option is added to the `FIPSR` ruleset in AIDE. If using a custom ruleset or the `acl` option is missing, add `acl` to the appropriate ruleset. For example, add `acl` to the following line in `/etc/aide.conf`:
    FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256
AIDE rules can be configured in multiple ways; this is merely one example that is already configured by default. The remediation provided with this rule adds `acl` to all rule sets available in `/etc/aide.conf` | ACLs can provide permissions beyond those permitted through the file mode and must be verified by the file integrity tools.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Add nodev Option to /boot | The `nodev` mount option can be used to prevent device files from being created in `/boot`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/boot`. | The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.
CM-7(a) CM-7(b) CM-6(a) MP-7 | Disable Modprobe Loading of USB Storage Driver | To prevent USB storage devices from being used, configure the kernel module loading system to prevent automatic loading of the USB storage driver. To configure the system to prevent the `usb-storage` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:
    install usb-storage /bin/true
This will prevent the `modprobe` program from loading the `usb-storage` module, but will not prevent an administrator (or another program) from using the `insmod` program to load the module manually. | USB storage devices such as thumb drives can be used to introduce malicious software.
CM-7(a) CM-7(b) CM-6(a) | Disable Avahi Publishing | To prevent Avahi from publishing its records, edit `/etc/avahi/avahi-daemon.conf` and ensure the following line appears in the `[publish]` section:
    disable-publishing=yes
| This helps ensure that no record will be published by Avahi.
CM-7(a) CM-7(b) CM-6(a) IA-5(1)(c) | Uninstall ypserv Package | The `ypserv` package can be removed with the following command:
    $ sudo yum erase ypserv
| The NIS service provides an unencrypted authentication service which does not provide for the confidentiality and integrity of user passwords or the remote session. Removing the `ypserv` package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services.
CM-7(a) CM-7(b) CM-6(a) | Disable Quagga Service | The `zebra` service can be disabled with the following command:
    $ sudo systemctl mask --now zebra.service
| Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If routing daemons are used when not required, system network information may be unnecessarily transmitted across the network.
CM-7(a) CM-7(b) CM-6(a) | Remove Rsh Trust Files | The files `/etc/hosts.equiv` and `~/.rhosts` (in each user's home directory) list remote hosts and users that are trusted by the local system when using the rshd daemon. To remove these files, run the following command to delete them from any location:
    $ sudo rm /etc/hosts.equiv
    $ rm ~/.rhosts
| This action is only meaningful if `.rhosts` support is permitted through PAM. Trust files are convenient, but when used in conjunction with the R-services, they can allow unauthenticated access to a system.
CM-7(a) CM-7(b) CM-6(a) AC-17(a) | Disable GSSAPI Authentication | Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms like GSSAPI. The default SSH configuration disallows authentications based on GSSAPI. The appropriate configuration is used if no value is set for `GSSAPIAuthentication`. To explicitly disable GSSAPI authentication, add or correct the following line in `/etc/ssh/sshd_config`:
    GSSAPIAuthentication no
| GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system.
CM-7(a) CM-7(b) CM-6(a) | Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces | To set the runtime status of the `net.ipv6.conf.all.accept_source_route` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.accept_source_route = 0
| Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required.
CM-7(a) CM-7(b) CM-6(a) | Disable Postfix Network Listening | Edit the file `/etc/postfix/main.cf` to ensure that only the following `inet_interfaces` line appears:
    inet_interfaces = loopback-only
| This ensures `postfix` accepts mail messages (such as cron job reports) from the local system only, and not from the network, which protects it from network attack.
CM-7(a) CM-7(b) CM-6(a) AC-6 AC-6(1) MP-7 | Bind Mount /var/tmp To /tmp | The `/var/tmp` directory is a world-writable directory. Bind-mount it to `/tmp` in order to consolidate temporary storage into one location protected by the same techniques as `/tmp`. To do so, edit `/etc/fstab` and add the following line:
    /tmp     /var/tmp     none     rw,nodev,noexec,nosuid,bind     0 0
See the `mount(8)` man page for further explanation of bind mounting. | Having multiple locations for temporary storage is not required. Unless absolutely necessary to meet requirements, the storage location `/var/tmp` should be bind mounted to `/tmp` and thus share the same protections.
CM-7(a) CM-7(b) CM-6(a) | Disable ntpdate Service (ntpdate) | The `ntpdate` service sets the local hardware clock by polling NTP servers when the system boots. It synchronizes to the NTP servers listed in `/etc/ntp/step-tickers` or `/etc/ntp.conf` and then sets the local hardware clock to the newly synchronized system time. The `ntpdate` service can be disabled with the following command:
    $ sudo systemctl mask --now ntpdate.service
| The `ntpdate` service may only be suitable for systems which are rebooted frequently enough that clock drift does not cause problems between reboots. In any event, the functionality of the ntpdate service is now available in the ntpd program and should be considered deprecated.
CM-7(a) CM-7(b) CM-6(a) CM-6(b) CM-6.1(iv) | Disable Kernel Parameter for IPv6 Forwarding | To set the runtime status of the `net.ipv6.conf.all.forwarding` kernel parameter, run the following command:
    $ sudo sysctl -w net.ipv6.conf.all.forwarding=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    net.ipv6.conf.all.forwarding = 0
| IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for systems acting as routers.
SC-7(10) | Restrict usage of ptrace to descendant processes | To set the runtime status of the `kernel.yama.ptrace_scope` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.yama.ptrace_scope=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.yama.ptrace_scope = 1
| Unrestricted usage of ptrace allows compromised binaries to run ptrace on another processes of the user. Like this, the attacker can steal sensitive information from the target processes (e.g. SSH sessions, web browser, ...) without any additional assistance from the user (i.e. without resorting to phishing).
AC-8(a) AC-8(c) | Set the GNOME3 Login Warning Banner Text | In the default graphical environment, configuring the login warning banner text in the GNOME Display Manager's login screen can be configured on the login screen by setting `banner-message-text` to `'APPROVED_BANNER'` where APPROVED_BANNER is the approved banner for your environment. To enable, add or edit `banner-message-text` to `/etc/dconf/db/gdm.d/00-security-settings`. For example:
    [org/gnome/login-screen]
    banner-message-text='APPROVED_BANNER'
Once the setting has been added, add a lock to `/etc/dconf/db/gdm.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/login-screen/banner-message-text
After the settings have been set, run `dconf update`. When entering a warning banner that spans several lines, remember to begin and end the string with `'` and use `\n` for new lines. | An appropriate warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers.
AC-8(a) AC-8(b) AC-8(c) | Enable GNOME3 Login Warning Banner | In the default graphical environment, displaying a login warning banner in the GNOME Display Manager's login screen can be enabled on the login screen by setting `banner-message-enable` to `true`. To enable, add or edit `banner-message-enable` to `/etc/dconf/db/gdm.d/00-security-settings`. For example:
    [org/gnome/login-screen]
    banner-message-enable=true
Once the setting has been added, add a lock to `/etc/dconf/db/gdm.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/login-screen/banner-message-enable
After the settings have been set, run `dconf update`. The banner text must also be set. | Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. For U.S. Government systems, system use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist.
AC-8(a) AC-8(c) AC-17(a) CM-6(a) | Enable SSH Warning Banner | To enable the warning banner and ensure it is consistent across the system, add or correct the following line in `/etc/ssh/sshd_config`:
    Banner /etc/issue
Another section contains information on how to create an appropriate system-wide warning banner. | The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.
AC-8(a) AC-8(c) | Modify the System Login Banner | To configure the system login banner edit `/etc/issue`. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is either: `You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.` OR: `I've read & consent to terms in IS user agreem't.` | Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist.
AC-8(a) AC-8(c) AC-17(a) CM-6(a) | Enable SSH Warning Banner | To enable the warning banner and ensure it is consistent across the system, add or correct the following line in `/etc/ssh/sshd_config`:
    Banner /etc/issue.net
Another section contains information on how to create an appropriate system-wide warning banner. | The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.
CM-8(3) IA-3 | Install usbguard Package | The `usbguard` package can be installed with the following command:
    $ sudo yum install usbguard
| `usbguard` is a software framework that helps to protect against rogue USB devices by implementing basic whitelisting/blacklisting capabilities based on USB device attributes.
AC-9 AC-17(a) CM-6(a) | Enable SSH Print Last Log | Ensure that SSH will display the date and time of the last successful account logon. The default SSH configuration enables print of the date and time of the last login. The appropriate configuration is used if no value is set for `PrintLastLog`. To explicitly enable LastLog in SSH, add or correct the following line in `/etc/ssh/sshd_config`:
    PrintLastLog yes
| Providing users feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.
AC-9(1) CM-6(a) | Ensure PAM Displays Last Logon/Access Notification | To configure the system to notify users of last logon/access using `pam_lastlog`, add or correct the `pam_lastlog` settings in `/etc/pam.d/postlogin` to read as follows:
    session     required pam_lastlog.so showfailed
And make sure that the `silent` option is not set. | Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the number of unsuccessful attempts that were made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.
AU-9(3) CM-6(a) | Encrypt Audit Records Sent With audispd Plugin | Configure the operating system to encrypt the transfer of off-loaded audit records onto a different system or media from the system being audited. Uncomment the `enable_krb5` option in
    /etc/audisp/audisp-remote.conf
, and set it with the following line:
    enable_krb5 = yes
| Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
AC-10 CM-6(a) | Limit the Number of Concurrent Login Sessions Allowed Per User | Limiting the number of allowed users and sessions per user can limit risks related to Denial of Service attacks. This addresses concurrent sessions for a single account and does not address concurrent sessions by a single user via multiple accounts. To set the number of concurrent sessions per user add the following line in `/etc/security/limits.conf` or a file under `/etc/security/limits.d/`:
    * hard maxlogins 1
| Limiting simultaneous user logins can insulate the system from denial of service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions.
IA-11 | Disallow Configuration to Bypass Password Requirements for Privilege Escalation | Verify the operating system is not configured to bypass password requirements for privilege escalation. Check the configuration of the "/etc/pam.d/sudo" file with the following command:
    $ sudo grep pam_succeed_if /etc/pam.d/sudo
If any occurrences of "pam_succeed_if" is returned from the command, this is a finding. | Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate.
AC-11(a) CM-6(a) | Set GNOME3 Screensaver Lock Delay After Activation Period | To activate the locking delay of the screensaver in the GNOME3 desktop when the screensaver is activated, add or set `lock-delay` to `uint32 `0`` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/screensaver]
    lock-delay=uint32 0
Once the setting has been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/screensaver/lock-delay
After the settings have been set, run `dconf update`. | A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to logout because of the temporary nature of the absense.
AU-11 CM-6(a) | Configure auditd flush priority | The `auditd` service can be configured to synchronously write audit event data to disk. Add or correct the following line in `/etc/audit/auditd.conf` to ensure that audit event data is fully synchronized with the log files on the disk:
    flush = data
| Audit data should be synchronously written to disk to ensure log integrity. These parameters assure that all audit event data is fully synchronized with the log files on the disk.
SI-11(a) SI-11(b) | Disable Core Dumps for SUID programs | To set the runtime status of the `fs.suid_dumpable` kernel parameter, run the following command:
    $ sudo sysctl -w fs.suid_dumpable=0
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    fs.suid_dumpable = 0
| The core dump of a setuid program is more likely to contain sensitive data, as the program itself runs with greater privileges than the user who initiated execution of the program. Disabling the ability for any setuid program to write a core file decreases the risk of unauthorized access of such data.
CM-11(a) CM-11(b) CM-6(a) CM-5(3) SA-12 SA-12(10) | Ensure gpgcheck Enabled for Local Packages | `yum` should be configured to verify the signature(s) of local packages prior to installation. To configure `yum` to verify signatures of local packages, set the `localpkg_gpgcheck` to `1` in `/etc/yum.conf`. | Changes to any software components can have significant effects to the overall security of the operating system. This requirement ensures the software has not been tampered and has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.
AU-11 CM-6(a) | Configure auditd Number of Logs Retained | Determine how many log files `auditd` should retain when it rotates logs. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting NUMLOGS with the correct value of `5`:
    num_logs = NUMLOGS
Set the value to 5 for general-purpose systems. Note that values less than 2 result in no log rotation. | The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum log file size and the number of logs retained.
IA-11 CM-6(a) | Ensure Users Re-Authenticate for Privilege Escalation - sudo | The sudo `NOPASSWD` and `!authenticate` option, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that `NOPASSWD` and/or `!authenticate` do not exist in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`." | Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.
AC-11(a) CM-6(a) | Set GNOME3 Screensaver Inactivity Timeout | The idle time-out value for inactivity in the GNOME3 desktop is configured via the `idle-delay` setting must be set under an appropriate configuration file(s) in the `/etc/dconf/db/local.d` directory and locked in `/etc/dconf/db/local.d/locks` directory to prevent user modification. For example, to configure the system for a 15 minute delay, add the following to `/etc/dconf/db/local.d/00-security-settings`:
    [org/gnome/desktop/session]
    idle-delay=uint32 900
Once the setting has been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/session/idle-delay
After the settings have been set, run `dconf update`. | A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME3 can be configured to identify when a user's session has idled and take action to initiate a session lock.
SI-11(a) SI-11(b) | Restrict Access to Kernel Message Buffer | To set the runtime status of the `kernel.dmesg_restrict` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.dmesg_restrict=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.dmesg_restrict = 1
| Unprivileged access to the kernel syslog can expose sensitive kernel address information.
IA-11 CM-6(a) | Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate | The sudo `!authenticate` option, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that the `!authenticate` option does not exist in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`. | Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.
AU-11 CM-6(a) | Configure auditd Max Log File Size | Determine the amount of audit data (in megabytes) which should be retained in each log file. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting the correct value of `6` for STOREMB:
    max_log_file = STOREMB
Set the value to `6` (MB) or higher for general-purpose systems. Larger values, of course, support retention of even more audit data. | The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum log file size and the number of logs retained.
IA-11 CM-6(a) | Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD | The sudo `NOPASSWD` tag, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that the `NOPASSWD` tag does not exist in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`. | Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.
IA-11 | The operating system must require Re-Authentication when using the sudo command. Ensure sudo timestamp_timeout is appropriate - sudo timestamp_timeout | The sudo `timestamp_timeout` tag sets the amount of time sudo password prompt waits. The default `timestamp_timeout` value is 5 minutes. The timestamp_timeout should be configured by making sure that the `timestamp_timeout` tag exists in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`. If the value is set to an integer less than 0, the user's time stamp will not expire and the user will not have to re-authenticate for privileged actions until the user's session is terminated. | Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.
AC-11(1) CM-6(a) AC-11(1).1 | Implement Blank Screensaver | To set the screensaver mode in the GNOME3 desktop to a blank screen, add or set `picture-uri` to `string ''` in `/etc/dconf/db/local.d/00-security-settings`. For example:
    [org/gnome/desktop/screensaver]
    picture-uri=''
Once the settings have been added, add a lock to `/etc/dconf/db/local.d/locks/00-security-settings-lock` to prevent user modification. For example:
    /org/gnome/desktop/screensaver/picture-uri
After the settings have been set, run `dconf update`. | Setting the screensaver mode to blank-only conceals the contents of the display from passersby.
AC-12 SC-10 AC-2(5) CM-6(a) | Set Interactive Session Timeout | Setting the `TMOUT` option in `/etc/profile` ensures that all user sessions will terminate based on inactivity. The `TMOUT` setting in a file loaded by `/etc/profile`, e.g. `/etc/profile.d/tmout.sh` should read as follows:
    TMOUT=600
| Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended.
SC-12(2) SC-12(3) IA-7 SC-13 CM-6(a) SC-12 | The Installed Operating System Is FIPS 140-2 Certified | To enable processing of sensitive information the operating system must provide certified cryptographic modules compliant with FIPS 140-2 standard. | The Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS PUB 140-2) is a computer security standard. The standard specifies security requirements for cryptographic modules used to protect sensitive unclassified information. Refer to the full FIPS 140-2 standard at http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf for further details on the requirements. FIPS 140-2 validation is required by U.S. law when information systems use cryptography to protect sensitive government information. In order to achieve FIPS 140-2 certification, cryptographic modules are subject to extensive testing by independent laboratories, accredited by National Institute of Standards and Technology (NIST).
SC-12(2) SC-12(3) IA-7 SC-13 CM-6(a) SC-12 | Ensure '/etc/system-fips' exists | On a system where FIPS mode is enabled, `/etc/system-fips` must exist. To enable FIPS mode, run the following command:
    fips-mode-setup --enable
| Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.
SC-12(2) SC-12(3) IA-7 SC-13 CM-6(a) SC-12 | Install the dracut-fips-aesni Package | To enable FIPS on system that support the Advanced Encryption Standard (AES) or New Instructions (AES-NI) engine, the system requires that the `dracut-fips-aesni` package be installed. The `dracut-fips-aesni` package can be installed with the following command:
    $ sudo yum install dracut-fips-aesni
| Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.
SC-12(2) SC-12(3) IA-7 SC-13 CM-6(a) SC-12 | Install the dracut-fips Package | To enable FIPS, the system requires that the `dracut-fips` package be installed. The `dracut-fips` package can be installed with the following command:
    $ sudo yum install dracut-fips
| Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.
SC-12(2) SC-12(3) IA-7 SC-13 CM-6(a) SC-12 | Enable FIPS Mode in GRUB2 | To ensure FIPS mode is enabled, install package `dracut-fips`, and rebuild `initramfs` by running the following commands:
    $ sudo yum install dracut-fips
    dracut -f
After the `dracut` command has been run, add the argument `fips=1` to the default GRUB 2 command line for the Linux operating system in `/etc/default/grub`, in the manner below:
    GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=VolGroup/LogVol06 rd.lvm.lv=VolGroup/lv_swap rhgb quiet rd.shell=0 fips=1"
Finally, rebuild the `grub.cfg` file by using the
    grub2-mkconfig -o
- command as follows: On BIOS-based machines, issue the following command as `root`:
      ~]# grub2-mkconfig -o /boot/grub2/grub.cfg
- On UEFI-based machines, issue the following command as `root`:
      ~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg
| Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.
SC-12(3) CM-6(a) | Configure SSSD LDAP Backend Client CA Certificate | Configure SSSD to implement cryptography to protect the integrity of LDAP remote access sessions. By setting the
    ldap_tls_cacert
option in
    /etc/sssd/sssd.conf
to point to the path for the X.509 certificates used for peer authentication.
    ldap_tls_cacert /path/to/tls/ca.cert
| Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.
SC-12(3) CM-6(a) | Configure SSSD LDAP Backend Client CA Certificate Location | Configure SSSD to implement cryptography to protect the integrity of LDAP remote access sessions. By setting the
    ldap_tls_cacertdir
option in
    /etc/sssd/sssd.conf
to point to the path for the X.509 certificates used for peer authentication.
    ldap_tls_cacertdir /path/to/tls/cacert
| Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.
SC-12(3) CM-6(a) | Configure SSSD LDAP Backend Client to Demand a Valid Certificate from the Server | Configure SSSD to demand a valid certificate from the server to protect the integrity of LDAP remote access sessions by setting the
    ldap_tls_reqcert
option in
    /etc/sssd/sssd.conf
to `demand`. | Without a valid certificate presented to the LDAP client backend, the identity of a server can be forged compromising LDAP remote access sessions.
SC-13 CM-6(a) | Disable Prelinking | The prelinking feature changes binaries in an attempt to decrease their startup time. In order to disable it, change or add the following line inside the file `/etc/sysconfig/prelink`:
    PRELINKING=no
Next, run the following command to return binaries to a normal, non-prelinked state:
    $ sudo /usr/sbin/prelink -ua
| Because the prelinking feature changes binaries, it can interfere with the operation of certain software and/or modes such as AIDE, FIPS, etc.
AC-17(a) CM-6(b) CM-7(a) CM-7(b) | Enable SSH Server firewalld Firewall Exception | By default, inbound connections to SSH's port are allowed. If the SSH server is being used but denied by the firewall, this exception should be added to the firewall configuration. To configure `firewalld` to allow access, run the following command(s): `firewall-cmd --permanent --add-service=ssh` | If inbound SSH connections are expected, adding a firewall rule exception will allow remote access through the SSH port.
AC-17(a) CM-6(a) AC-6(1) | Verify Permissions on SSH Server Public *.pub Key Files | To properly set the permissions of `/etc/ssh/*.pub`, run the command:
    $ sudo chmod 0644 /etc/ssh/*.pub
| If a public host key file is modified by an unauthorized user, the SSH service may be compromised.
AC-17(a) MA-4(6) CM-6(a) AC-4 SC-8 | Verify Any Configured IPSec Tunnel Connections | Libreswan provides an implementation of IPsec and IKE, which permits the creation of secure tunnels over untrusted networks. As such, IPsec can be used to circumvent certain network requirements such as filtering. Verify that if any IPsec connection (`conn`) configured in `/etc/ipsec.conf` and `/etc/ipsec.d` exists is an approved organizational connection. | IP tunneling mechanisms can be used to bypass network filtering.
AC-17(a) CM-7(a) CM-7(b) CM-6(a) | Disable SSH Support for .rhosts Files | SSH can emulate the behavior of the obsolete rsh command in allowing users to enable insecure access to their accounts via `.rhosts` files. The default SSH configuration disables support for `.rhosts`. The appropriate configuration is used if no value is set for `IgnoreRhosts`. To explicitly disable support for .rhosts files, add or correct the following line in `/etc/ssh/sshd_config`:
    IgnoreRhosts yes
| SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.
AC-17(a) AC-17(1) CM-6(a) | Set SSH Daemon LogLevel to VERBOSE | The `VERBOSE` parameter configures the SSH daemon to record login and logout activity. To specify the log level in SSH, add or correct the following line in `/etc/ssh/sshd_config`:
    LogLevel VERBOSE
| SSH provides several logging levels with varying amounts of verbosity. `DEBUG` is specifically not recommended other than strictly for debugging SSH communications since it provides so much data that it is difficult to identify important security information. `INFO` or `VERBOSE` level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.
AC-17(a) CM-7(a) CM-7(b) CM-6(a) | Disable SSH Access via Empty Passwords | Disallow SSH login with empty passwords. The default SSH configuration disables logins with empty passwords. The appropriate configuration is used if no value is set for `PermitEmptyPasswords`. To explicitly disallow SSH login from accounts with empty passwords, add or correct the following line in `/etc/ssh/sshd_config`:
    PermitEmptyPasswords no
Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords. | Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.
AC-17(a) CM-6(a) AC-6(1) | Verify Permissions on SSH Server Private *_key Key Files | To properly set the permissions of `/etc/ssh/*_key`, run the command:
    $ sudo chmod 0600 /etc/ssh/*_key
| If an unauthorized user obtains the private SSH host key file, the host could be impersonated.
AC-17(a) AC-17(2) CM-6(a) MA-4(6) SC-13 SC-12(2) SC-12(3) | Harden SSHD Crypto Policy | Crypto Policies are means of enforcing certain cryptographic settings for selected applications including OpenSSH server. The SSHD service is by default configured to modify its configuration based on currently configured Crypto-Policy. However, in certain cases it might be needed to override the Crypto Policy specific to OpenSSH Server and leave rest of the Crypto Policy intact. This can be done by dropping a file named `opensshserver-xxx.config`, replacing `xxx` with arbitrary identifier, into `/etc/crypto-policies/local.d`. This has to be followed by running `update-crypto-policies` so that changes are applied. Changes are propagated into `/etc/crypto-policies/back-ends/opensshserver.config`. This rule checks if this file contains predefined `CRYPTO_POLICY` environment variable configured with predefined value. | The Common Criteria requirements specify that certain parameters for OpenSSH Server are configured e.g. supported ciphers, accepted host key algorithms, public key types, key exchange algorithms, HMACs and GSSAPI key exchange is disabled. Currently particular requirements specified by CC are stricter compared to any existing Crypto Policy.
AC-17(a) CM-7(a) CM-7(b) CM-6(a) | Disable Kerberos Authentication | Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms like Kerberos. The default SSH configuration disallows authentication validation through Kerberos. The appropriate configuration is used if no value is set for `KerberosAuthentication`. To explicitly disable Kerberos authentication, add or correct the following line in `/etc/ssh/sshd_config`:
    KerberosAuthentication no
| Kerberos authentication for SSH is often implemented using GSSAPI. If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementations may be subject to exploitation.
AC-17(a) AC-17(2) CM-6(a) MA-4(6) SC-13 | Harden SSH client Crypto Policy | Crypto Policies are means of enforcing certain cryptographic settings for selected applications including OpenSSH client. To override the system wide crypto policy for Openssh client, place a file in the `/etc/ssh/ssh_config.d/` so that it is loaded before the `05-redhat.conf`. In this case it is file named `02-ospp.conf` containing parameters which need to be changed with respect to the crypto policy. This rule checks if the file exists and if it contains required parameters and values which modify the Crypto Policy. During the parsing process, as soon as Openssh client parses some configuration option and its value, it remembers it and ignores any subsequent overrides. The customization mechanism provided by crypto policies appends eventual customizations at the end of the system wide crypto policy. Therefore, if the crypto policy customization overrides some parameter which is already configured in the system wide crypto policy, the SSH client will not honor that customized parameter. | The Common Criteria requirements specify how certain parameters for OpenSSH Client are configured. Particular parameters are RekeyLimit, GSSAPIAuthentication, Ciphers, PubkeyAcceptedKeyTypes, MACs and KexAlgorithms. Currently particular requirements specified by CC are stricter compared to any existing Crypto Policy.
AC-17(a) CM-7(a) CM-7(b) CM-6(a) | Do Not Allow SSH Environment Options | Ensure that users are not able to override environment variables of the SSH daemon. The default SSH configuration disables environment processing. The appropriate configuration is used if no value is set for `PermitUserEnvironment`. To explicitly disable Environment options, add or correct the following `/etc/ssh/sshd_config`:
    PermitUserEnvironment no
| SSH environment options potentially allow users to bypass access restriction in some configurations.
AC-17(a) CM-6(a) | Set LogLevel to INFO | The INFO parameter specifices that record login and logout activity will be logged. The default SSH configuration sets the log level to INFO. The appropriate configuration is used if no value is set for `LogLevel`. To explicitly specify the log level in SSH, add or correct the following line in `/etc/ssh/sshd_config`:
    LogLevel INFO
| SSH provides several logging levels with varying amounts of verbosity. `DEBUG` is specifically not recommended other than strictly for debugging SSH communications since it provides so much data that it is difficult to identify important security information. `INFO` level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.
AC-17(a) CM-7(a) CM-7(b) CM-6(a) | Disable SSH Support for Rhosts RSA Authentication | SSH can allow authentication through the obsolete rsh command through the use of the authenticating user's SSH keys. This should be disabled. To ensure this behavior is disabled, add or correct the following line in `/etc/ssh/sshd_config`:
    RhostsRSAAuthentication no
| Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.
AC-17(a) CM-7(a) CM-7(b) CM-6(a) | Disable Compression Or Set Compression to delayed | Compression is useful for slow network connections over long distances but can cause performance issues on local LANs. If use of compression is required, it should be enabled only after a user has authenticated; otherwise, it should be disabled. To disable compression or delay compression until after a user has successfully authenticated, add or correct the following line in the `/etc/ssh/sshd_config` file:
    Compression no
| If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.
AC-17(a) CM-7(a) CM-7(b) CM-6(a) | Disable SSH Support for User Known Hosts | SSH can allow system users to connect to systems if a cache of the remote systems public keys is available. This should be disabled. To ensure this behavior is disabled, add or correct the following line in `/etc/ssh/sshd_config`:
    IgnoreUserKnownHosts yes
| Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.
AC-17(1) AU-14(1) AU-10 CM-6(a) IR-5(1) | Enable Auditing for Processes Which Start Prior to the Audit Daemon | To ensure all processes can be audited, even those which start prior to the audit daemon, add the argument `audit=1` to the default GRUB 2 command line for the Linux operating system. To ensure that `audit=1` is added as a kernel command line argument to newly installed kernels, ad `audit=1` to the default Grub2 command line for Linux operating systems. Modify the line within `/etc/default/grub` as shown below:
    GRUB_CMDLINE_LINUX="... audit=1 ..."
Run the following command to update command line for already installed kernels:
    # grubby --update-kernel=ALL --args="audit=1"
| Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although `auditd` takes care of enabling this for all processes which launch after it does, adding the kernel argument ensures it is set for every process during boot.
AC-18(a) AC-18(3) CM-7(a) CM-7(b) CM-6(a) MP-7 | Disable Bluetooth Kernel Module | The kernel's module loading system can be configured to prevent loading of the Bluetooth module. Add the following to the appropriate `/etc/modprobe.d` configuration file to prevent the loading of the Bluetooth module:
    install bluetooth /bin/true
| If Bluetooth functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation.
AC-18(a) AC-18(3) CM-7(a) CM-7(b) CM-6(a) MP-7 | Deactivate Wireless Network Interfaces | Deactivating wireless network interfaces should prevent normal usage of the wireless capability. Configure the system to disable all wireless network interfaces with the following command:
    $ sudo nmcli radio wifi off
| The use of wireless networking can introduce many different attack vectors into the organization's network. Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to create a denial of service to valid network resources.
SC-20(a) CM-6(a) | Configure Multiple DNS Servers in /etc/resolv.conf | Multiple Domain Name System (DNS) Servers should be configured in `/etc/resolv.conf`. This provides redundant name resolution services in the event that a domain server crashes. To configure the system to contain as least `2` DNS servers, add a corresponding `nameserver ip_address` entry in `/etc/resolv.conf` for each DNS server where ip_address is the IP address of a valid DNS server. For example:
    search example.com
    nameserver 192.168.0.1
    nameserver 192.168.0.2
| To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.
SC-30 SC-30(2) CM-6(a) | Enable Randomized Layout of Virtual Address Space | To set the runtime status of the `kernel.randomize_va_space` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.randomize_va_space=2
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.randomize_va_space = 2
| Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code in order to re-purpose it using return oriented programming (ROP) techniques.
SC-30 SC-30(2) SC-30(5) CM-6(a) | Restrict Exposed Kernel Pointer Addresses Access | To set the runtime status of the `kernel.kptr_restrict` kernel parameter, run the following command:
    $ sudo sysctl -w kernel.kptr_restrict=1
To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`:
    kernel.kptr_restrict = 1
| Exposing kernel pointers (through procfs or `seq_printf()`) exposes kernel writeable structures that can contain functions pointers. If a write vulnereability occurs in the kernel allowing a write access to any of this structure, the kernel can be compromise. This option disallow any program withtout the CAP_SYSLOG capability from getting the kernel pointers addresses, replacing them with 0.
SC-39 CM-6(a) | Enable NX or XD Support in the BIOS | Reboot the system and enter the BIOS or Setup configuration menu. Navigate the BIOS configuration menu and make sure that the option is enabled. The setting may be located under a Security section. Look for Execute Disable (XD) on Intel-based systems and No Execute (NX) on AMD-based systems. | Computers with the ability to prevent this type of code execution frequently put an option in the BIOS that will allow users to turn the feature on or off at will.
NONE | Configure audit according to OSPP requirements | Configure audit to meet requirements for Operating System Protection Profile (OSPP) v4.2.1. Audit defines groups of rules in `/usr/share/doc/audit/rules` to satisfy specific policies. To fulfill requirements for compliance with OSPP v4.2.1, the following files are necessary: /usr/share/doc/audit-VERSION/rules/10-base-config.rules /usr/share/doc/audit-VERSION/rules/11-loginuid.rules /usr/share/doc/audit-VERSION/rules/30-ospp-v42.rules /usr/share/doc/audit-VERSION/rules/43-module-load.rules Copy the files from `/usr/share/doc/audit/rules` to `/etc/audit/rules.d`:
    cp /usr/share/doc/audit*/rules/{10-base-config,11-loginuid,30-ospp-v42,43-module-load}.rules /etc/audit/rules.d/
| The audit rules defined in `/usr/share/doc/audit/rules` are the recommended way to meet compliance with OSPP v4.2.1.